CVE-2026-58048: cPanel Root SQL Execution Flaw Patched

TL;DR: cPanel patched a cPanel root SQL execution flaw tracked as CVE-2026-58048, rated CVSS 9.4. A second, lower-severity bug, CVE-2026-58047, allows HTTP request smuggling under limited conditions.

Why it matters

An independent vulnerability database describes the flaw as rooted in improper handling of SQL mode settings during database renaming operations. That gap allows a cPanel root SQL execution path that bypasses normal privilege limits entirely.

An authenticated cPanel account holder with MySQL or MariaDB access could run arbitrary database commands with full administrative privileges. Depending on the server setup, this may extend to operating-system-level compromise.

Shared hosting environments face the highest exposure here. Many hosting customers hold cPanel accounts without needing or expecting root-level database access, which makes this cPanel root SQL execution bug especially concerning for providers running multi-tenant servers.

How the attacks work

CVE-2026-58048 stems from the database rename function failing to preserve its intended SQL execution context. This opens a cPanel root SQL execution path for otherwise limited users. Separately, CVE-2026-58047 affects the cpsrvd web server component, letting an unauthenticated attacker manipulate responses sent to other users on the same server under limited conditions.

Exploitation status

No public proof-of-concept or in-the-wild exploitation has been confirmed for either CVE at this time.

Affected versions and patch

Both flaws affect all supported cPanel and WHM versions. Patched builds include 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP2. Administrators who cannot upgrade immediately can revoke the MySQL feature from cPanel users as a stopgap against the root SQL execution bug, and consult cPanel’s support articles for the request-smuggling workaround.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.