Improper preservation of SQL mode when renaming databases in cPanel

CVE-2026-58048 is an SQL injection in cPanel & WHM's database rename functionality. When a cPanel user renames a database, the system fails to preserve the active SQL mode context, allowing a crafted rename request to break out of the intended operation and execute arbitrary SQL statements as the MySQL/MariaDB root user. This affects all supported release branches: 11.110.x (before .0.137), 11.118.x (before .0.71), 11.126.x (before .0.78), 11.134.x (before .0.48), 11.136.x (before .0.32), and WP Squared 138.x (before 1.6). The flaw was disclosed on 2026-07-31 and discovered by researcher Vincent55 Yang.

There is no official vendor CVSS score from cPanel/WebPros. Third-party databases like VulDB assigned a CVSS 4.0 score of 9.4 (Critical), which reflects the raw technical severity — network-accessible, low privilege required, high impact across confidentiality, integrity, and availability. However, the 9.4 overstates the risk for most enterprise defenders because it ignores the authenticated-access prerequisite and the fact that cPanel is predominantly a shared-hosting tool, not a component found on typical enterprise endpoints. For hosting providers, the 9.4 is closer to reality; for enterprise teams managing internal infrastructure, HIGH at 8.0 better captures the actual risk.

Why this verdict

• Cross-tenant database breach: MySQL root SQL execution breaks tenant isolation — one compromised or malicious account can dump every database on the server, including credentials, PII, and application secrets for all co-hosted sites.
• Authenticated but low-bar: The prerequisite is a valid cPanel account, which in shared hosting is purchasable for a few dollars. This is not 'stolen admin credentials' friction — it is commercially available access.
• Role multiplier: cPanel servers are *by definition* multi-tenant production database hosts. The blast radius of MySQL root on a shared hosting server is tenant → all tenants (potentially hundreds of sites). For hosting providers, ≥90% of cPanel installations occupy this high-value multi-tenant role. For enterprise defenders, cPanel is rare on internal infrastructure, but where it exists it typically hosts production web properties. The floor is HIGH based on the canonical multi-tenant database role.
• No PoC or active exploitation: No public exploit code, no KEV listing, EPSS at 0.5%. This significantly reduces immediate urgency and prevents an upgrade to CRITICAL.
• 1.5M exposed instances: The internet-facing population is large, making this an attractive future target once exploitation details emerge.

Why not higher?

A CRITICAL rating would require either active exploitation, a public PoC lowering the exploitation bar, or an unauthenticated attack vector. None of these conditions exist today. The authenticated requirement — while low-friction in hosting — still requires the attacker to possess or obtain valid credentials, which is a meaningful gate. Additionally, for enterprise defenders (the primary audience), cPanel is uncommon on internal infrastructure, limiting the likely exposure population.

Why not lower?

Despite the authenticated prerequisite, the blast radius is too severe for MEDIUM. MySQL root execution on a multi-tenant server is not a single-account compromise — it is a mass-breach enabler affecting every co-hosted customer. The 1.5 million internet-facing instances represent a large vulnerable population, and the absence of a PoC today does not mean one won't emerge given the straightforward CWE-89 classification. The canonical deployment role of cPanel (multi-tenant production hosting) sets a HIGH floor.

1. Disable MySQL/MariaDB feature for untrusted accounts — In WHM → Feature Manager, disable the 'MySQL Databases' and 'MySQL Database Wizard' features for account packages assigned to low-trust or external-facing tenants. This removes the attack surface entirely for those accounts. Deploy within 30 days per noisgate mitigation SLA for HIGH severity.
2. Enable MySQL general query logging temporarily — Set general_log = ON in MySQL/MariaDB to capture all SQL statements, enabling detection of anomalous cross-tenant queries. This has performance impact — use it as a short-term detection measure while patching is underway, not as a permanent control.
3. Restrict cPanel API access via IP allowlisting — In WHM → Security Center → Host Access Control, restrict access to cPanel and WHM interfaces to known management IPs. This limits who can reach the vulnerable rename endpoint.
4. Audit and rotate database credentials — After patching, rotate all MySQL user passwords and application database credentials on affected servers. If the vulnerability was exploited, attacker-created database users or modified grants may persist.

Run this script on each cPanel/WHM server as root. It checks the installed cPanel build number against the patched versions for each release branch. Usage: sudo bash check_cve_2026_58048.sh

#!/usr/bin/env bash
# CVE-2026-58048 Patch Verification
# Checks cPanel/WHM build against patched versions
# Run as root on the target cPanel server
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
  echo "UNKNOWN - must run as root"
  exit 2
fi

VERSION_FILE="/usr/local/cpanel/version"
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN - cPanel not installed (no $VERSION_FILE)"
  exit 2
fi

VER=$(cat "$VERSION_FILE" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$VER" ]]; then
  echo "UNKNOWN - could not read cPanel version"
  exit 2
fi

echo "Detected cPanel version: $VER"

# version_gte: returns 0 if $1 >= $2 using sort -V
version_gte() {
  [[ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" == "$2" ]]
}

# Patched versions per branch
declare -A PATCHED=(
  ["11.110"]="11.110.0.137"
  ["11.118"]="11.118.0.71"
  ["11.126"]="11.126.0.78"
  ["11.134"]="11.134.0.48"
  ["11.136"]="11.136.0.32"
  ["11.138"]="11.138.1.6"
)

BRANCH=$(echo "$VER" | grep -oP '^11\.\d+')
if [[ -z "$BRANCH" ]]; then
  echo "UNKNOWN - unrecognized version branch: $VER"
  exit 2
fi

if [[ -z "${PATCHED[$BRANCH]+x}" ]]; then
  echo "UNKNOWN - branch $BRANCH not in known affected list"
  exit 2
fi

FIXED="${PATCHED[$BRANCH]}"
if version_gte "$VER" "$FIXED"; then
  echo "PATCHED - $VER >= $FIXED (CVE-2026-58048)"
  exit 0
else
  echo "VULNERABLE - $VER < $FIXED (CVE-2026-58048)"
  exit 1
fi

Sources

1. THREATINT CVE-2026-58048 Entry
2. CyberPress — cPanel WHM Database Privilege Escalation
3. GBHackers — cPanel Database Privilege Escalation Flaw
4. VulDB — CVE-2026-58048
5. Censys — cPanel Internet Exposure Analysis
6. Datanyze — cPanel Market Share
7. SecurityOnline — cPanel WHM Patch Advisory