---
schema: 1
kind: vulnerability
title: "CVE-2026-58048 — cPanel & WHM: renaming a database drops the SQL mode that contains a tenant, handing any hosting customer database-root (CVSS 9.4)"
headline: "A shared-hosting tenant boundary fails on a database rename, and the Swiss NCSC put it on its own dashboard"
summary: >
  WebPros patched two flaws in cPanel & WHM on 2026-08-04. CVE-2026-58048 (CVSS v4.0 9.4, assigned by the HackerOne
  CNA) fails to preserve SQL mode when a database is renamed, so SQL executes in root context: an authenticated
  cPanel account holder who merely has the MySQL/MariaDB feature enabled can run arbitrary database commands with
  full administrative privileges, extending to operating-system-level compromise on some configurations. The same
  release fixes CVE-2026-58047, an HTTP request-smuggling flaw in the cpsrvd web server that under limited
  conditions lets an unauthenticated attacker manipulate responses delivered to other users on the same server. All
  supported versions are affected; both are fixed across the 11.110 through 11.136 build lines and WP Squared
  138.1.6, and both have vendor-documented interim mitigations.
discovered_at: "2026-08-06T04:11:48Z"
event_date: "2026-08-04"
run_id: 2026-08-06T0411Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, priv-esc, patch-available]
regions: [global]
sectors: [technology, public-sector]
entities: []
techniques: [T1068, T1190]
affected_products: ["cPanel & WHM", "WP Squared"]
cves:
  - id: CVE-2026-58048
    cvss: "9.4"
    epss: null
    type: priv-esc
    vector: zero-click
    auth: post-auth
    status: [patch-available]
    affected: "All supported versions of cPanel & WHM, and WP Squared"
    fixed: "11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and WP Squared 138.1.6"
  - id: CVE-2026-58047
    cvss: "5.6"
    epss: null
    type: logic-flaw
    vector: zero-click
    auth: pre-auth
    status: [patch-available, mitigation-only]
    affected: "All supported versions of cPanel & WHM, and WP Squared"
    fixed: "11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and WP Squared 138.1.6"
sources:
  - url: "https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation"
    publisher: "cPanel / WebPros"
    date: "2026-08-04"
    role: primary
  - url: "https://support.cpanel.net/hc/en-us/articles/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling"
    publisher: "cPanel / WebPros"
    date: "2026-08-04"
    role: primary
  - url: "https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html"
    publisher: "The Hacker News"
    date: "2026-08-04"
    role: corroborating
  - url: "https://security-hub.ncsc.admin.ch/#/posts/12827"
    publisher: "NCSC Switzerland — Cyber Security Hub"
    date: "2026-08-05"
    role: corroborating
closed_sources: []
evidence:
  - quote: "could potentially execute arbitrary database commands with full administrative privileges"
    publisher: "cPanel / WebPros"
  - quote: "manipulate responses delivered to other users on the same server"
    publisher: "cPanel / WebPros"
  - quote: "SQL mode is not preserved when a database is renamed, causing SQL to execute in root context"
    publisher: "The Hacker News"
verification: multi-source
sourcing_note: >
  The vendor's own two advisories state impact, affected and patched versions and the interim mitigations, but not
  the root cause; the mechanism — SQL mode not being preserved across a database rename — comes from the HackerOne
  CNA record and is quoted here from the outlet that reports it, not attributed to the vendor pages, which do not
  contain that sentence. The CVSS v4.0 9.4 for CVE-2026-58048 is the CNA's score; the vendor advisory publishes no
  score of its own, and the 5.6 for CVE-2026-58047 is likewise carried by the reporting rather than the vendor.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "On any cPanel & WHM server that cannot be updated to the patched build this week, revoke the MySQL feature from the cPanel feature lists of accounts that do not need it — WebPros states this blocks the privilege-escalation path without disabling databases that already exist, only preventing their addition and removal."
migrated_from: null
---

WebPros shipped a targeted cPanel & WHM security release on 2026-08-04 carrying two flaws that both cross an account boundary. In CVE-2026-58048 the vendor's stated impact is that an authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges, and that depending on the operating system and database engine configuration this may extend to operating-system-level compromise ([cPanel / WebPros, 2026-08-04](https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation)). The vendor advisory stops there and does not give a mechanism; the root cause is recorded in the HackerOne CNA entry, which states that SQL mode is not preserved when a database is renamed, causing SQL to execute in root context ([The Hacker News, 2026-08-04](https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html)). The same reporting carries the CNA's CVSS v4.0 score of 9.4 ([The Hacker News, 2026-08-04](https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html)).

The prerequisite reads as a mitigating factor and mostly is not one in the environment where cPanel actually runs. On a shared or reseller hosting platform, "an authenticated cPanel account holder" is any paying customer, and the database-rename operation is a routine self-service function. So the boundary this breaks is tenant-to-server: one customer account reaching the database identity that serves every account on the box. That is why the Swiss NCSC placed it on its own Cyber Security Hub dashboard for its constituency ([NCSC Switzerland, 2026-08-05](https://security-hub.ncsc.admin.ch/#/posts/12827)), and why it is in scope here — cantonal, communal and public-sector-adjacent web estates in the region are commonly hosted on exactly this control panel rather than on infrastructure the organisation runs itself.

The second flaw, CVE-2026-58047, is an HTTP request-smuggling issue in cpsrvd, the daemon serving the cPanel and WHM interfaces; the vendor states that in some situations an unauthenticated remote attacker may be able to manipulate responses delivered to other users on the same server ([cPanel / WebPros, 2026-08-04](https://support.cpanel.net/hc/en-us/articles/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling)). Neither flaw is reported exploited by any party. Both are fixed in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48 and 11.136.0.32, and in WP Squared 138.1.6 ([cPanel / WebPros, 2026-08-04](https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation)).

**Defender takeaway:** both have vendor-documented interim controls, which matters because hosting platforms rarely take an unscheduled control-panel upgrade. For the database flaw, removing the MySQL feature from accounts that do not need it blocks the path while leaving existing databases working ([cPanel / WebPros, 2026-08-04](https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation)). For the smuggling flaw, disabling cpsrvd backend connection reuse forces a new TCP and TLS connection per request on ports 2083, 2087 and 2096, which the vendor notes increases latency and CPU on busy servers and should be reverted after upgrading ([cPanel / WebPros, 2026-08-04](https://support.cpanel.net/hc/en-us/articles/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling)). If you consume hosting rather than operate it, the practical step is to ask the provider which build they are on, because nothing on the tenant side detects or prevents either issue.

Detection is thin by nature here and worth being honest about: exploitation of the database flaw is a legitimate, authenticated user invoking a legitimate feature, so it produces no anomalous authentication and no unusual process. What it does produce is database-server activity executing under the administrative account in the immediate wake of a rename operation on a customer database — the discriminator is the privilege level of the executing session rather than the operation itself, visible in database audit logs where those are enabled at all. Response manipulation from the smuggling flaw surfaces, if anywhere, as responses on the control-panel ports that do not correspond to the requesting session.