{"id":10392,"date":"2026-08-04T21:05:55","date_gmt":"2026-08-05T01:05:55","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10392"},"modified":"2026-08-04T20:46:35","modified_gmt":"2026-08-05T00:46:35","slug":"cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/","title":{"rendered":"cPanel patches a bug that let regular hosting users act as database root"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\"><a href=\"https:\/\/www.cpanel.net\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">cPanel<\/a> just shipped a security release that closes a hole most hosting customers never knew existed. Specifically, it let an ordinary, authenticated account run SQL commands with full administrative database privileges.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\"><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2026-58048<\/a> carries a CVSS 4.0 score of 9.4, and it touches every supported version of cPanel &amp; WHM plus WP Squared. To exploit it, an attacker only needs a valid cPanel account with access to the MySQL or MariaDB feature, and plenty of regular customers already have that.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">From there, cPanel says the account holder could run arbitrary database commands as if they held root access. Depending on the server&#8217;s OS and database setup, that access could even reach the operating system itself.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">The bug sits in cPanel&#8217;s database-renaming process. Normally, when a database gets renamed, the system should preserve SQL mode throughout the move. Instead, it doesn&#8217;t, so the SQL ends up executing in the database&#8217;s administrative context. <a href=\"https:\/\/hostingdiscussion.com\/news\/cpanel-issues-critical-updates-to-patch-high-risk-security-flaws\/\">cPanel<\/a> labels this privilege escalation, while HackerOne&#8217;s own record classifies the same defect as SQL injection. Either way, neither one names the exact payload or the affected SQL mode.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Fortunately, patches are already live in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. For anyone who can&#8217;t update immediately, revoking the <a href=\"https:\/\/www.mysql.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">MySQL<\/a> feature from cPanel users works as a stopgap. That way, existing databases keep running, but users lose the ability to add or remove new ones.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Meanwhile, two smaller issues shipped alongside it. First, CVE-2026-58047 is a request-smuggling bug in cpsrvd that could let an unauthenticated attacker manipulate responses meant for other users, and as a result, credentials could leak. Second, an Exim flaw could let Team User sub-accounts escalate privileges through a local user&#8217;s .forward file. Fortunately, Exim 4.99.5 removes the vulnerable code that made that possible.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">So far, <a href=\"https:\/\/hostingdiscussion.com\/news\/cisa-flags-oracle-breach-after-silent-leak-of-customer-credentials\/\">CISA<\/a>&#8216;s August 4 enrichment found no active exploitation and rated the flaw non-automatable, though that&#8217;s only a snapshot from that date. Meanwhile, one more wrinkle is worth flagging: cPanel&#8217;s own advisories don&#8217;t fully agree on which builds carry the fix. Therefore, anyone running build 11.118 specifically should check the database advisory directly instead of relying on the shorter lists in the other two.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>cPanel just shipped a security release that closes a hole most hosting customers never knew existed. Specifically, it let an ordinary, authenticated account run SQL commands with full administrative database privileges. CVE-2026-58048 carries a CVSS 4.0 score of 9.4, and it touches every supported version of cPanel &amp; WHM plus WP Squared. To exploit it, [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[203,7616,7614,7615,7613,7500],"class_list":["post-10392","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cpanel","tag-cpsrvd-request-smuggling","tag-cve-2026-58048","tag-database-privilege-escalation","tag-security-patch","tag-whm-vulnerability"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>cPanel patches a bug that let regular hosting users act as database root - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"cPanel patches a bug that let regular hosting users act as database root - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"cPanel just shipped a security release that closes a hole most hosting customers never knew existed. Specifically, it let an ordinary, authenticated account run SQL commands with full administrative database privileges. CVE-2026-58048 carries a CVSS 4.0 score of 9.4, and it touches every supported version of cPanel &amp; WHM plus WP Squared. To exploit it, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-05T01:05:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-05T00:46:35+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/\",\"name\":\"cPanel patches a bug that let regular hosting users act as database root - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-08-05T01:05:55+00:00\",\"dateModified\":\"2026-08-05T00:46:35+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"cPanel patches a bug that let regular hosting users act as database root\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"cPanel patches a bug that let regular hosting users act as database root - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/","og_locale":"en_US","og_type":"article","og_title":"cPanel patches a bug that let regular hosting users act as database root - Web Hosting News","og_description":"cPanel just shipped a security release that closes a hole most hosting customers never knew existed. Specifically, it let an ordinary, authenticated account run SQL commands with full administrative database privileges. CVE-2026-58048 carries a CVSS 4.0 score of 9.4, and it touches every supported version of cPanel &amp; WHM plus WP Squared. To exploit it, [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/","og_site_name":"Web Hosting News","article_published_time":"2026-08-05T01:05:55+00:00","article_modified_time":"2026-08-05T00:46:35+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/","url":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/","name":"cPanel patches a bug that let regular hosting users act as database root - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-08-05T01:05:55+00:00","dateModified":"2026-08-05T00:46:35+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"cPanel patches a bug that let regular hosting users act as database root"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":79,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10392"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10392\/revisions"}],"predecessor-version":[{"id":10393,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10392\/revisions\/10393"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}