A critical vulnerability affecting cPanel and its associated WHM interface has been disclosed, receiving the identifier CVE-2026-58048 and a CVSS score of 9.4.
The flaw permits any authenticated cPanel user to execute arbitrary SQL statements with the privileges of the MySQL root account, effectively bypassing normal database restrictions.
Because the issue resides in a core function that handles database renaming, exploitation does not require additional system privileges beyond a standard hosting account.
Administrators are urged to treat the bug as an immediate threat to the integrity of shared hosting platforms.
The root cause lies in insufficient input validation during the database rename operation, where a specially crafted request can trick the process into executing with elevated credentials.
When the rename routine is invoked, the application fails to drop the caller’s context before invoking the underlying SQL engine, allowing the supplied query to run as the database superuser.
An attacker who controls a cPanel account can therefore issue commands such as CREATE USER, DROP DATABASE or GRANT ALL PRIVILEGES, actions that would normally be barred.
If chained with local privilege escalation vectors, the flaw could lead to full root access on the host operating system.
The same security advisory also addresses CVE-2026-58047, a medium‑severity issue rated at 5.6 on the CVSS scale.
This second defect involves improper handling of certain HTTP headers, enabling a limited request smuggling scenario under specific configurations.
No public exploits have been observed for either vulnerability, but the high‑score flaw has prompted urgent patching guidance from the vendor.
While no threat actor has been publicly associated with CVE-2026-58048, the nature of the bug makes it particularly appealing for actors targeting multi‑tenant hosting environments.
A successful exploit could allow an adversary to read, modify or delete any database hosted on the server, create new MySQL accounts with unrestricted rights, and potentially write files to the filesystem via SQL commands such as SELECT ... INTO OUTFILE.
Such capabilities could be used to install web shells, steal sensitive customer data, or launch further attacks against neighbouring tenants.
The vulnerability highlights the importance of rapid patch deployment in shared‑hosting infrastructures where isolation relies heavily on application‑level controls.
cPanel has released patched builds that address the flaw, including versions 11.110.0.137, 11.126.0.78 and 11.134.0.48 among others.
System administrators should prioritise applying these updates to all servers running the control panel, preferably through the usual update mechanism or by manually downloading the packages from the official site.
As an interim measure, disabling the MySQL feature for individual cPanel accounts prevents the vulnerable rename function from being invoked, although this may affect legitimate database management tasks.
Organisations unable to patch immediately should consider implementing network‑level restrictions that limit outbound database connections from the hosting partition.
Even after patching, reviewing database logs for unexpected queries such as unexpected GRANT or CREATE statements can help detect attempted exploitation.
Enabling audit logging at the MySQL level and forwarding those records to a central SIEM provides early warning of anomalous activity.
Additionally, ensuring that backup credentials and encryption keys are stored outside the compromised host reduces the impact of a successful breach.
Full details of the vulnerability and the corresponding patches are available in the vendor’s security notice here.
Further analysis and commentary can be found in articles from Security Affairs and The Hacker News.