Critical cPanel & WHM Vulnerability Allows Root-Level SQL Command Execution
A critical privilege-escalation flaw, CVE-2026-58048, in cPanel & WHM allows authenticated users to execute arbitrary SQL commands as root, potentially leading to full server compromise.
A critical privilege-escalation vulnerability, identified as CVE-2026-58048, has been disclosed in cPanel & WHM, a widely used control panel for web hosting. This flaw allows authenticated users with a valid cPanel account to execute arbitrary SQL commands with root-level database administrative privileges. The exploitation requires access to the MySQL or MariaDB features within the cPanel interface.
The vulnerability is particularly concerning for shared hosting environments, where multiple customers may reside on the same server. A low-privileged user could leverage their existing database management access to escalate their privileges to that of a database administrator, bypassing normal permission restrictions. This could enable them to perform actions far beyond their intended scope.
According to cPanel, all supported versions of the software that have not yet received the vendor's patched releases are affected. The potential impact varies depending on the server's operating system, database engine, and specific configuration. In many scenarios, administrative execution at the database level can be leveraged to gain access to the underlying operating system, leading to a full server compromise.
Successful exploitation could result in the exposure of sensitive customer databases, unauthorized modification of database users and permissions, theft of credentials, deployment of malicious database triggers, or even access to server files through database capabilities. In configurations where MySQL or MariaDB have elevated filesystem access, the risk extends to a complete server takeover.
cPanel has released patched versions to address this critical flaw. Administrators are strongly urged to update their cPanel & WHM installations immediately to one of the following fixed versions: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or 138.1.6 for WP2 deployments.
For administrators unable to patch immediately, a temporary mitigation involves revoking the MySQL feature from affected cPanel users through feature list management. This measure prevents users from adding or removing databases, thereby limiting the potential for exploitation while maintaining access to existing databases.
Security teams should proactively review database audit logs for any signs of unexpected administrative SQL activity. This includes monitoring for newly created database users, unusual privilege assignments, modifications to stored procedures, and suspicious file-related database operations. Hosting providers, in particular, should pay close attention to accounts with recently created databases or any anomalous changes to MySQL/MariaDB permissions.
Security researcher Vincent55 Yang is credited with responsibly reporting this vulnerability. While the vendor has not yet publicly disclosed detailed technical exploitation information, the severity of the potential privilege escalation necessitates rapid remediation. Organizations relying on cPanel infrastructure should prioritize patching this vulnerability as a high-priority security event.
The new article details two additional vulnerabilities patched in the same cPanel security release. CVE-2026-58047, a CVSS 5.6 HTTP request-smuggling flaw in the cPanel/WHM daemon, could lead to credential leakage. Additionally, a local privilege escalation vulnerability in Exim, triggered by a user's .forward file under specific configurations, was also addressed.