cPanel has released security updates to fix a critical vulnerability that could allow authenticated hosting customers to execute SQL commands with the database server’s root privileges.
The flaw, tracked as CVE-2026-58048, has a CVSS 4.0 score of 9.4 and affects all supported versions of cPanel & WHM as well as WP Squared.
The vulnerability requires a valid cPanel account with access to MySQL or MariaDB. If exploited, an attacker could execute arbitrary SQL commands using the database’s administrative account, bypassing the normal privilege restrictions applied to hosting users. Depending on the operating system and database configuration, cPanel warns that the flaw could potentially lead to a full operating system compromise.
According to the company, the issue is caused by the database renaming process. During a database rename, SQL mode is not preserved, allowing SQL statements to run in the root database context instead of the limited privileges normally assigned to cPanel users. While cPanel describes the issue as a privilege escalation, the official CVE classifies it as CWE-89 (SQL Injection). However, the advisory does not reveal the exact SQL payload, affected SQL mode, or the specific input that could be abused.
The vulnerability has been fixed in the following releases:
- cPanel & WHM 11.110.0.137
- cPanel & WHM 11.118.0.71
- cPanel & WHM 11.126.0.78
- cPanel & WHM 11.134.0.48
- cPanel & WHM 11.136.0.32
- WP Squared 138.1.6
Administrators are advised to install the latest updates immediately. Those unable to update can temporarily reduce the risk by disabling the MySQL feature for cPanel users. Existing databases will continue working, but users will no longer be able to create or delete databases until updates are applied. Systems can be updated through WHM or by running:
/usr/local/cpanel/scripts/upcp --forceThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) noted on August 4 that there is no evidence of active exploitation and classified the flaw as non-automatable, although it rated the technical impact as total if successfully exploited.
Alongside the database vulnerability, cPanel also fixed CVE-2026-58047, an HTTP request smuggling flaw in the cpsrvd service. The vulnerability could allow an unauthenticated attacker to manipulate HTTP responses sent to other users on the same server, potentially exposing authentication credentials under limited conditions.
For administrators unable to patch immediately, cPanel recommends disabling backend connection reuse by setting:
cpsrvd_keepalives_disabled=1in /var/cpanel/cpanel.config before restarting cpsrvd. The company notes that this workaround increases CPU usage and latency because every request requires a new TCP and TLS connection.
The security release also includes updates for Exim 4.99.5, addressing two local privilege escalation vulnerabilities. One flaw could allow unsafe string expansion through .forward files under specific configurations, while another fixes a directory traversal issue that could allow access to files outside Exim’s spool directory.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
One point of confusion remains in cPanel’s documentation. While the advisory for the database vulnerability lists version 11.118.0.71 as patched, the advisories covering the request smuggling and Exim vulnerabilities do not include the 11.118 branch in their fixed version lists. Administrators using that branch should verify they are running the latest available point release before assuming all vulnerabilities have been addressed.
cPanel Fixes Critical Flaw That Could Give Hosting Users Root Database Access
