Blog
cPanel CVE-2026-58048: The Database Root Flaw Every Host Should Patch Today
Table of Contents
Quick summary
Looking for affordable server licenses? SharedLicense offers cPanel, DirectAdmin, LiteSpeed, CloudLinux, and Windows licenses at wholesale prices with instant delivery.
Browse licenses →Disclosure: This is a news analysis based on the cPanel vendor advisory and public CVE records. SharedLicense sells cPanel licenses and has a commercial interest in keeping servers patched and supported.
Fast-Scan Summary
- The flaw is CVE-2026-58048, CVSS 4.0 score 9.4, a database privilege escalation.
- Trigger requires a valid cPanel account plus access to the MySQL/MariaDB feature.
- It lets the account holder run SQL in the database root context, which cPanel says may extend to OS level compromise.
- Root cause: SQL mode is not preserved when a database is renamed inside cPanel.
- Patched builds: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32 (and 138.1.6 for WP Squared).
- Fix command:
/usr/local/cpanel/scripts/upcp --force. - Temporary mitigation if you cannot patch now: revoke the MySQL feature from cPanel accounts.
What CVE-2026-58048 Actually Does
Under normal operation, cPanel grants database privileges that do not require SUPER access or allow global changes. CVE-2026-58048 bypasses those limits. With a valid cPanel account and the MySQL or MariaDB feature enabled, an account holder can execute arbitrary database commands with full administrative privileges. Depending on the operating system and database engine configuration, cPanel says this may extend to operating system level compromise.
There is a naming wrinkle worth knowing. The vendor advisory titles the issue a privilege escalation and does not use the words SQL injection. The CVE record, classified by the HackerOne CNA, labels the same defect CWE-89, SQL injection. Two labels, one bug, viewed from different angles. Neither record names the injected input, the affected SQL mode, or a payload.
{{VERIFY: CVSS score, affected products, and root cause | cPanel vendor advisory CVE-2026-58048; NVD CVE-2026-58048}}
Which cPanel Builds Are Patched
| Product | Branch | Patched build |
|---|---|---|
| cPanel & WHM | 11.110 | 11.110.0.137 |
| cPanel & WHM | 11.118 | 11.118.0.71 |
| cPanel & WHM | 11.126 | 11.126.0.78 |
| cPanel & WHM | 11.134 | 11.134.0.48 |
| cPanel & WHM | 11.136 | 11.136.0.32 |
| WP Squared | 138 | 138.1.6 |
Check your installed version in WHM under cPanel & WHM Updates, or run /usr/local/cpanel/cpanel -V from root. Anything below the patched point release for your branch needs updating.
How to Patch CVE-2026-58048 Now
/usr/local/cpanel/scripts/upcp --forceAfter the update finishes, restart cpsrvd if the script asks you to, then recheck the version. On a multi server estate, run the update in a maintenance window, because a failed or partial update can leave cpsrvd mid restart.
Need the best price on server licenses?
Get cPanel, DirectAdmin, LiteSpeed & more with instant delivery and 24/7 support.
{{VERIFY: update command and procedure | cPanel documentation, How do I update cPanel and WHM}}
The Workaround If You Cannot Update Immediately
This is a containment move, not a fix. The flaw still exists in unpatched code, and any account that already holds database access before you revoke the feature remains a live path. Treat the workaround as a bridge to a same day or same week patch, not as a long term policy.
Two More Flaws Fixed in the Same Release
| ID | What it is | Severity | Where it is fixed |
|---|---|---|---|
| CVE-2026-58047 | HTTP request smuggling in cpsrvd on ports 2083, 2087, 2096. An unauthenticated remote attacker may manipulate responses to other users, and credentials could leak. |
CVSS 4.0 score 5.6 | Same cPanel release. Workaround: set cpsrvd_keepalives_disabled=1 in /var/cpanel/cpanel.config and restart cpsrvd. |
| GCVE-25-2026-07-45-3 | Exim .forward unsafe string expansion in the redirect router under certain pipe transport configs. Under cPanel’s default config it runs as the cPanel user and may allow escalation from Team User sub accounts. |
Privilege escalation | Exim 4.99.5 removes the vulnerable expansion. |
| GCVE-25-2026-07-45-1 | Exim local directory traversal through queue name command line arguments. Can reach files outside the spool area and enable escalation. | High | Exim 4.99.5. |
The request smuggling workaround has a cost. cPanel says disabling backend connection reuse forces a fresh TCP and TLS connection for every request on 2083, 2087, and 2096, which raises latency and CPU use on busy servers. Use it only until you can patch. cPanel credits researcher Vincent55 Yang with reporting both cPanel CVEs. The Exim advisories name no researcher.
{{VERIFY: CVE-2026-58047 and Exim GCVE details | cPanel advisories; Exim Security 2026-06-22 advisories}}
Who Is Actually at Risk
A server whose accounts all belong to one company is a different proposition from a shared host selling accounts to strangers. On a shared box, any paying customer who can open phpMyAdmin is inside the trigger conditions. The line is not clean either, because accounts get phished, resold, or taken over. CISA’s August 4 enrichment recorded no exploitation, rated the flaw non automatable, and rated its technical impact as total. That snapshot says nothing about the days since publication, so treat “none exploited” as a moment, not a verdict.
A Build List Discrepancy Worth Checking
If you run any 11.118 build, do not trust the shorter lists from the other two advisories. Check your installed point release against the database advisory, and assume the branch still needs the database patch even if the companion CVEs look unsupported on it. This is the kind of gap that bites operators who skim the headline CVE and skip the build table, and it is the single most useful thing to verify beyond running the updater.
FAQ: CVE-2026-58048, Answered
What is CVE-2026-58048?
How do I patch CVE-2026-58048?
/usr/local/cpanel/scripts/upcp --force as root. Then confirm the installed build matches one of the patched releases.Can I mitigate CVE-2026-58048 without updating?
Which cPanel versions are patched?
Stay Patched, Stay Supported
The pattern with cPanel flaws is consistent. A CVE lands, the patched builds ship the same day, and the hosts who update inside the first 48 hours avoid the window where scanners start probing for the unpatched versions. Run the updater, confirm the build, and if you cannot patch today, revoke the MySQL feature as a bridge.
Keeping cPanel on a current, licensed build is what makes that response possible in the first place. At SharedLicense we keep hosting providers running for less with affordable licenses for cPanel, DirectAdmin, LiteSpeed, CloudLinux, JetBackup, and Imunify360. Compare cPanel license options at SharedLicense.
Sources
- cPanel vendor advisory: CVE-2026-58048, Database Privilege Escalation (support.cpanel.net)
- NVD entry: CVE-2026-58048 (nvd.nist.gov)
- CISA Vulnrichment snapshot, August 4, 2026 (github.com/cisagov/vulnrichment)
- cPanel advisories: CVE-2026-58047 (HTTP Request Smuggling) and GCVE-25-2026-07-45-3 (Exim .forward)
- Exim Security 2026-06-22 advisories (exim.org)
- Original reporting: The Hacker News, August 4, 2026
