cPanel patches critical database flaw that let hosting customers run SQL as root

Key points

• CPanel has patched CVE-2026-58048, a critical flaw carrying a CVSS 4.0 score of 9.4, that let a logged-in hosting customer run database commands as the server's root user.
• The fix ships in a targeted security release that also closes two other bugs allowing a customer to step outside their own account.
• The flaw required an authenticated cPanel account, so it isn't a drive-by internet attack, but on shared hosting servers one paying customer could reach every other customer's data.
• Shared hosting providers running cPanel should apply the update immediately and review database logs for unusual root-level queries.

CPanel, the control panel software running on a large share of the world's shared web hosting servers, has patched a serious flaw that let one paying customer take over the server's entire database.

The bug is tracked as CVE-2026-58048 and carries a CVSS 4.0 severity score of 9.4 out of 10. A customer already logged into their own cPanel account could send database commands that ran as the database's root user, the top-level administrator that can read or modify every database on the server. We first reported on this CVE on 4 August 2026.

What actually went wrong?

CPanel failed to keep a wall between two very different identities on the same machine: the limited hosting customer, and the all-powerful database administrator. A customer sending SQL, the structured language used to query databases, could have those commands executed with root privileges rather than their own restricted ones.

On a shared hosting server, that boundary is the whole product. Dozens or hundreds of unrelated websites sit on one box, each customer meant to see only their own files and their own database. Cross that line and every other tenant is exposed. Attackers who compromise GitHub repositories to hunt cPanel servers are already active, as we reported on 23 July 2026, making a privilege escalation route like this one especially dangerous right now.

The vendor hasn't reported evidence of the flaw being exploited in the wild.

Who is affected?

Any hosting company or business running an unpatched version of cPanel on a server with more than one customer. That covers a large slice of small-business web hosting worldwide, from local resellers to large budget hosts.

The attacker has to be authenticated: they need a working cPanel login. On a shared server that bar is low. Anyone with a valid hosting plan on the same machine qualifies, and a hacker could simply buy a cheap plan on a target host and use it as a launch point.

Should ordinary website owners be worried?

If your site is on shared cPanel hosting, ask your provider two questions: have you applied this security release, and have you reviewed database activity for anything unusual. A good host will answer both without hedging.

Customers can't patch this themselves; only the hosting provider can. What you can do is rotate the passwords stored inside your site's database, particularly admin logins for WordPress or any other content system, once your host confirms the update is in place. If an attacker read the database before the patch landed, those old passwords are the first thing they'll try.

What to watch next

Proof-of-concept exploit code typically surfaces publicly within weeks of a critical cPanel disclosure. Hosts that delay patching past that point become soft targets. The real test here isn't whether cPanel shipped a fix, it's whether shared hosting providers apply it before someone publishes a working exploit.