For three months, the cPanel security story has been about attackers forcing the front door. The vendor's newest release flips that script: this time, the person holding the keys is a paying customer on the same box as everyone else.
cPanel has patched CVE-2026-58048, a critical privilege escalation rated 9.4 under CVSS 4.0. It affects all supported versions of cPanel & WHM and WP Squared. An attacker needs nothing exotic — just a valid cPanel account with the MySQL/MariaDB feature enabled.
From there, WebPros says the account holder can run arbitrary database commands with full administrative privileges, and warns the damage may not stop at the database: "this may extend to operating-system-level compromise."
Researcher Vincent55 Yang reported the flaw through HackerOne, which published the CVE record on July 31.
The break happens somewhere unglamorous — the database rename function. Renaming a database in cPanel is not a relabelling job. The system spins up a replacement database, migrates the data, rebuilds grants and stored routines, then drops the original.
That housekeeping runs with the database's administrative identity, and cPanel fails to preserve SQL mode along the way, letting user-controlled SQL execute in root context. cPanel's advisory frames the issue as privilege escalation; the HackerOne CNA record tags it CWE-89, classic SQL injection. Same bug, two vocabularies.
The distinction that matters is who can reach it. cPanel normally caps customers at database-level privileges with no SUPER access and no global changes. This flaw erases that ceiling — and on a reseller or shared server, the person next door is a stranger who paid a few dollars for their foothold.
Compare that with April's CVE-2026-41940 authentication bypass, which Cyber Kendra reported had been exploited as a zero-day for roughly two months before the patch landed, leaving tens of thousands of servers compromised. That one required no credentials at all. This one requires an account, which is cheap.
What to do now
Update to build 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or 138.1.6 for WP Squared. Administrators can push it through WHM or run:
/usr/local/cpanel/scripts/upcp --force
If patching has to wait, strip the MySQL feature from customer feature lists. Existing databases keep running; users simply lose the ability to add or remove them.
The same release also fixes CVE-2026-58047, a request-smuggling flaw in the cpsrvd daemon, plus an Exim issue in which a local .forward file can trigger unsafe expansion under certain pipe-transport setups. Patch once, close all three.