Critical cPanel Flaw Lets Hosting Users Hijack Database Root Access

cPanel has shipped an emergency patch for a critical privilege-escalation vulnerability that lets authenticated hosting customers execute arbitrary SQL commands with full database-root privileges, breaking the trust boundary between a cPanel account and the server's administrative database identity. Tracked as CVE-2026-58048 and carrying a CVSS 4.0 base score of 9.4, the bug affects every supported version of cPanel & WHM along with WP Squared, and exploitation requires nothing more than a valid cPanel login plus access to the MySQL/MariaDB feature. According to the vendor, depending on the operating system and database engine configuration, successful exploitation could extend all the way to operating-system-level compromise.

The root cause sits in cPanel's database-renaming routine. The HackerOne CNA record explains that SQL mode is not preserved during a rename, causing SQL to execute in the root context rather than the constrained account context the user should normally see. Normally, cPanel enforces database-level privileges that exclude SUPER access and block global modifications; CVE-2026-58048 bypasses those controls entirely. The vendor classifies the issue as a privilege escalation, while the CNA labels it CWE-89 (SQL injection); neither record identifies the specific injected input, the affected SQL mode, or whether Team User sub-accounts satisfy its preconditions. Patched builds include 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. CISA's enrichment notes no observed exploitation so far and rates the flaw as non-automatable, though its technical impact is recorded as total.

Administrators running servers that cannot update immediately should revoke the MySQL feature from cPanel users via WHM; existing databases will continue operating, but users will be blocked from creating or removing databases. The full upgrade can be triggered from WHM or by running /usr/local/cpanel/scripts/upcp --force from the command line. Hosting providers should also review exposure scope, because the real-world risk depends heavily on who holds accounts on a given box: a single-tenant server used by one organization faces different threat potential than a multi-tenant host selling accounts to the public. Operators can run a quick port scanner to confirm which cPanel services are exposed externally and a SSL/TLS checker to make sure management endpoints are encrypted. Hosting customers worried their credentials may have surfaced elsewhere can validate them with an email breach checker and rotate any reused passwords before the patch is applied.