CVE-2026-58048 — cPanel & WHM: renaming a database drops the SQL mode that contains a tenant, handing any hosting customer database-root (CVSS 9.4)
WebPros shipped a targeted cPanel & WHM security release on 2026-08-04 carrying two flaws that both cross an account boundary. In CVE-2026-58048 the vendor's stated impact is that an authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges, and that depending on the operating system and database engine configuration this may extend to operating-system-level compromise (cPanel / WebPros, 2026-08-04). The vendor advisory stops there and does not give a mechanism; the root cause is recorded in the HackerOne CNA entry, which states that SQL mode is not preserved when a database is renamed, causing SQL to execute in root context (The Hacker News, 2026-08-04). The same reporting carries the CNA's CVSS v4.0 score of 9.4 (The Hacker News, 2026-08-04).
The prerequisite reads as a mitigating factor and mostly is not one in the environment where cPanel actually runs. On a shared or reseller hosting platform, "an authenticated cPanel account holder" is any paying customer, and the database-rename operation is a routine self-service function. So the boundary this breaks is tenant-to-server: one customer account reaching the database identity that serves every account on the box. That is why the Swiss NCSC placed it on its own Cyber Security Hub dashboard for its constituency (NCSC Switzerland, 2026-08-05), and why it is in scope here — cantonal, communal and public-sector-adjacent web estates in the region are commonly hosted on exactly this control panel rather than on infrastructure the organisation runs itself.
The second flaw, CVE-2026-58047, is an HTTP request-smuggling issue in cpsrvd, the daemon serving the cPanel and WHM interfaces; the vendor states that in some situations an unauthenticated remote attacker may be able to manipulate responses delivered to other users on the same server (cPanel / WebPros, 2026-08-04). Neither flaw is reported exploited by any party. Both are fixed in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48 and 11.136.0.32, and in WP Squared 138.1.6 (cPanel / WebPros, 2026-08-04).
Detection is thin by nature here and worth being honest about: exploitation of the database flaw is a legitimate, authenticated user invoking a legitimate feature, so it produces no anomalous authentication and no unusual process. What it does produce is database-server activity executing under the administrative account in the immediate wake of a rename operation on a customer database — the discriminator is the privilege level of the executing session rather than the operation itself, visible in database audit logs where those are enabled at all. Response manipulation from the smuggling flaw surfaces, if anywhere, as responses on the control-panel ports that do not correspond to the requesting session.
could potentially execute arbitrary database commands with full administrative privileges
manipulate responses delivered to other users on the same server
SQL mode is not preserved when a database is renamed, causing SQL to execute in root context
Defender actions
- On any cPanel & WHM server that cannot be updated to the patched build this week, revoke the MySQL feature from the cPanel feature lists of accounts that do not need it — WebPros states this blocks the privilege-escalation path without disabling databases that already exist, only preventing their addition and removal.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.