cPanel patches critical database flaw that let hosting customers run SQL as root

Key points

• cPanel has patched CVE-2026-58048, a critical flaw carrying a CVSS 4.0 score of 9.4, that let a logged-in hosting customer run database commands as the server's root user.
• The fix ships in a targeted security release that also closes two other bugs allowing a customer to step outside their own account.
• The flaw required an authenticated cPanel account, so it is not a drive-by internet attack, but on shared hosting servers one paying customer could reach every other customer's data.
• Shared hosting providers running cPanel should apply the update immediately and review database logs for unusual root-level queries.

cPanel, the control panel software that runs on a large share of the world's shared web hosting servers, has patched a serious flaw that let one paying customer take over the server's entire database.

The bug is tracked as CVE-2026-58048 and carries a CVSS 4.0 severity score of 9.4 out of 10. In plain English: a customer who was already logged into their own cPanel account could send database commands that ran as the database's root user, the top-level administrator account that can read or change every database on the server.

The issue was first reported by The Hacker News.

What actually went wrong?

cPanel failed to keep a wall between two very different identities on the same machine: the limited hosting customer, and the all-powerful database administrator. A customer sending SQL, the language used to query databases, could have those commands executed with root privileges rather than the account's own restricted ones.

On a shared hosting server, that boundary is the whole product. Dozens or hundreds of unrelated websites sit on one box, and each customer is meant to see only their own files and their own database. Cross that line and every other tenant on the server is exposed.

cPanel shipped the fix in a targeted security release that also addresses two other bugs allowing a customer to step past account boundaries. The vendor has not, at time of writing, reported evidence of the flaw being used in the wild.

Who is affected?

Any hosting company or business running an unpatched version of cPanel on a server that hosts more than one customer. That covers a large slice of small-business web hosting worldwide, from local resellers to large budget hosts.

The attacker has to be authenticated, meaning they need a working cPanel login. That sounds like a high bar, but on a shared server it is trivial: anyone with a valid hosting plan on the same machine qualifies. A hacker could also buy a cheap plan on a target host and use it as a launch point.

Should ordinary website owners be worried?

If your site is on shared cPanel hosting, ask your provider two questions: have you applied the November security release, and have you reviewed database activity for anything unusual. A good host will answer both without hedging.

Here is the shape of the risk in one place:

Customers themselves cannot patch this; only the hosting provider can. What you can do is rotate the passwords stored inside your site's database, particularly the admin logins for WordPress or any other content system, once your host confirms the update is in place. If an attacker read the database before the fix, old passwords are the currency they will try first.

What to watch next

Expect proof-of-concept exploit code to appear publicly in the coming weeks, which is the usual pattern after a critical cPanel disclosure. Hosts that delay patching past that point become soft targets.