New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
cPanel patches critical privilege escalation flaw allowing authenticated users to execute SQL as database root.
cPanel released security patches for CVE-2026-58048, a critical privilege escalation vulnerability affecting all supported versions of cPanel & WHM and WP Squared. The flaw allows authenticated hosting customers with MySQL/MariaDB access to execute arbitrary SQL commands with full database administrative privileges, potentially leading to OS-level compromise. Three other vulnerabilities were patched in the same release, including an HTTP request-smuggling issue (CVE-2026-58047) and an Exim unsafe string expansion bug.
AI summary of the linked source. Not reviewed by an editor. How this works
Run cPanel Inc.?
Get an email when a new story names cPanel Inc., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical privilege escalation vulnerability in cPanel & WHM (CVE-2026-58048) allowed authenticated hosting customers — who should operate within strictly limited tenant boundaries — to execute arbitrary SQL commands with full database administrative privileges. The root cause is improper enforcement of least-privilege principles at the database layer, meaning user-level MySQL/MariaDB access was not adequately sandboxed from root-level operations. This is particularly dangerous in shared hosting environments where hundreds of unrelated customers share the same underlying infrastructure, as one compromised or malicious tenant could pivot to OS-level control. The bundled HTTP request-smuggling and Exim vulnerabilities in the same release underscore the compounding risk of delaying patch cycles on complex, multi-service hosting control panels.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-58048
- cve — CVE-2026-58047