cPanel & WHM — HTTP request smuggling in cpsrvd allowing an unauthenticated attacker to manipulate responses delivered to other users on the same server (CVSS v4.0 5.6); interim mitigation disables cpsrvd backend connection reuse

CVE-2026-58048 — cPanel & WHM: renaming a database drops the SQL mode that contains a tenant, handing any hosting customer database-root (CVSS 9.4)

WebPros shipped a targeted cPanel & WHM security release on 2026-08-04 carrying two flaws that both cross an account boundary. In CVE-2026-58048 the vendor's stated impact is that an authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges, and that depending on the operating system and database engine configuration this may extend to operating-system-level compromise (cPanel / WebPros, 2026-08-04). The vendor advisory stops there and does not give a mechanism; the root cause is recorded in the HackerOne CNA entry, which states that SQL mode is not preserved when a database is renamed, causing SQL to execute in root context (The Hacker News, 2026-08-04). The same reporting carries the CNA's CVSS v4.0 score of 9.4 (The Hacker News, 2026-08-04).

The prerequisite reads as a mitigating factor and mostly is not one in the environment where cPanel actually runs. On a shared or reseller hosting platform, "an authenticated cPanel account holder" is any paying customer, and the database-rename operation is a routine self-service function. So the boundary this breaks is tenant-to-server: one customer account reaching the database identity that serves every account on the box. That is why the Swiss NCSC placed it on its own Cyber Security Hub dashboard for its constituency (NCSC Switzerland, 2026-08-05), and why it is in scope here — cantonal, communal and public-sector-adjacent web estates in the region are commonly hosted on exactly this control panel rather than on infrastructure the organisation runs itself.

The second flaw, CVE-2026-58047, is an HTTP request-smuggling issue in cpsrvd, the daemon serving the cPanel and WHM interfaces; the vendor states that in some situations an unauthenticated remote attacker may be able to manipulate responses delivered to other users on the same server (cPanel / WebPros, 2026-08-04). Neither flaw is reported exploited by any party. Both are fixed in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48 and 11.136.0.32, and in WP Squared 138.1.6 (cPanel / WebPros, 2026-08-04).

Detection is thin by nature here and worth being honest about: exploitation of the database flaw is a legitimate, authenticated user invoking a legitimate feature, so it produces no anomalous authentication and no unusual process. What it does produce is database-server activity executing under the administrative account in the immediate wake of a rename operation on a customer database — the discriminator is the privilege level of the executing session rather than the operation itself, visible in database audit logs where those are enabled at all. Response manipulation from the smuggling flaw surfaces, if anywhere, as responses on the control-panel ports that do not correspond to the requesting session.