cPanel Patches Critical Flaw Allowing Hosting Customers to Execute SQL as Database Root

Critical Privilege Escalation Vulnerability Addressed

cPanel has issued a targeted security release to patch CVE-2026-58048, a critical vulnerability with a CVSS 4.0 score of 9.4. This flaw enabled an authenticated hosting customer to execute SQL commands in the database's root context, bypassing normal privilege boundaries. The update also resolves two other account boundary bypass issues.

Affected Products and Conditions

The vulnerability impacts all supported versions of cPanel & WHM, as well as WP Squared. Exploitation requires a valid cPanel account and access to the MySQL/MariaDB feature. Under these conditions, an account holder could execute arbitrary database commands with full administrative privileges, potentially leading to an operating-system-level compromise depending on the server's configuration.

Patch Availability and Mitigation

cPanel has released patches in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. For servers that cannot be updated immediately, administrators can temporarily revoke the MySQL feature from cPanel users. This action prevents users from adding or removing databases but allows existing databases to continue functioning. Updates can be performed via WHM or by using the command `/usr/local/cpanel/scripts/upcp --force`.

Technical Details of the Flaw

The vulnerability stems from cPanel's database-renaming process. During a database rename, the SQL mode is not preserved, causing SQL to execute in the root context. Normally, cPanel enforces database-level privileges that do not grant SUPER access or global modifications. CVE-2026-58048 bypasses these limitations by allowing SQL to run with database administrative privileges. While the vendor advisory titles it a privilege escalation, the CNA classifies it as CWE-89, SQL injection.