cPanel August 2026 Security Alert: Database Root Privilege Escalation (CVE-2026-58048), HTTP Smuggling & Exim Flaws Patched

What Happened

cPanel released a targeted security update on August 4, 2026 addressing four vulnerabilities. One - CVE-2026-58048 - earned a CVSS 4.0 score of 9.4 and a CISA assessment of "technical impact: total." The researcher, Vincent55 Yang, found a way to make a routine database rename operation execute SQL in the database engine's root context.

If you manage cPanel servers, you need the August builds. The July patches did not cover CVE-2026-58048. CISA enriched the record on August 4 with "Exploitation: none" - a snapshot, not a guarantee.

The Four Vulnerabilities

CVE-2026-58048 - Database Rename → Root SQL (CVSS 9.4, Critical)

The mechanism: cPanel's database-renaming process does not preserve SQL mode when it moves data between databases. The flow works like this:

1. A cPanel account holder clicks "Rename Database" in the UI (or calls the API)
2. cPanel creates a replacement database with the new name
3. cPanel copies every table and row from the old database to the new one
4. cPanel recreates all grants, stored procedures, and triggers
5. cPanel drops the old database

Step 3 is where the flaw lives. When cPanel executes the data migration queries, it does not restore the SQL mode that would normally constrain statement execution. The database engine runs those queries in its root administrative context - not the cPanel user's limited context.

What this means in practice: A hosting customer with a single MySQL database can craft a database name containing carefully structured objects (triggers, stored procedures with DEFINER clauses, or event schedulers) that, when renamed, cause SQL to execute as the MySQL root user. From there, the attacker can:

• Read every database on the server (including other customers' data)
• Drop or modify any table on the MySQL/MariaDB instance
• Write files to disk via SELECT ... INTO OUTFILE (depending on secure_file_priv)
• Execute OS commands via sys_exec() if the MySQL plugin is loaded

CISA rated the technical impact as "total." The CNA classifies this as CWE-89 (SQL injection). cPanel calls it a privilege escalation. Both describe the same defect: SQL mode is not preserved during database rename, and the queries cPanel issues internally execute in root context.

Affected versions: All supported cPanel & WHM versions, including WP Squared. Patched builds:

Tier	Patched Build
STABLE	11.118.0.71
RELEASE	11.118.0.71
CURRENT	11.119.0.23
EDGE	11.119.0.23

If you run the 11.118 branch, verify you are on build 0.71. The other advisories in this release omit 11.118 from their lists - check the database advisory specifically.

Temporary workaround: Revoke the MySQL feature from cPanel users. This prevents them from creating or renaming databases but leaves existing databases running:

# For a specific user
/usr/local/cpanel/bin/cpmysql disable-user-features <username>

# Or revoke globally: edit each user's feature list in WHM
# WHM → Packages → Feature Lists → Edit → uncheck "MySQL Databases"

Caution: This breaks database creation and renaming for all affected users. Apply only if patching is delayed by more than 24 hours.

CVE-2026-58047 - HTTP Request Smuggling in cpsrvd (CVSS 5.6, Medium)

This is an HTTP request-smuggling vulnerability in cpsrvd - the daemon serving cPanel, WHM, and Webmail interfaces on ports 2083, 2087, and 2096. An unauthenticated attacker on the same network can manipulate responses delivered to other users by exploiting a disagreement between the front-end proxy and cpsrvd about request boundaries.

Credentials can leak as a result - a poisoned response could contain another user's session cookie.

Temporary workaround: Disable backend connection reuse. This forces a new TCP and TLS handshake for every request, which hits latency and CPU on busy servers but closes the smuggling window:

# Add to /var/cpanel/cpanel.config
echo 'cpsrvd_keepalives_disabled=1' >> /var/cpanel/cpanel.config

# Restart cpsrvd
/scripts/restartsrv_cpsrvd

Performance impact: Each cPanel login, WHM page load, and webmail session previously reused the TCP connection. With keepalives disabled, every request incurs a full TLS handshake. On a server handling 500 cPanel sessions, this adds measurable CPU overhead. Patch as soon as the build is available.

GCVE-25-2026-07-45-3 - Exim Forward File Privilege Escalation

A .forward file crafted by a cPanel account holder can trigger unsafe string expansion in the Exim redirect router when pipe transport configurations are active. The force_command option on the pipe transport, combined with execution as the cPanel user, allows privilege escalation from a Team User sub-account to the main cPanel account - and potentially higher.

Patched in: Exim 4.99.5, which removes the vulnerable expansion. The August cPanel builds ship this Exim version.

GCVE-25-2026-07-45-1 - Exim Queue-Name Directory Traversal (High)

This Exim flaw allows local directory traversal through queue-name command-line arguments. An attacker can access files outside the Exim spool directory and use the traversal for privilege escalation. Patched alongside GCVE-25-2026-07-45-3 in Exim 4.99.5.

Neither Exim advisory names a researcher. The credits note "the unnamed and uncredited authors whose works were ingested as the training corpus."

How to Patch

Step 1: Verify Your Current Build

cat /usr/local/cpanel/version

If you see 11.118.0.70 or lower, you are vulnerable to CVE-2026-58048.

Step 2: Update cPanel

/usr/local/cpanel/scripts/upcp --force

This updates cPanel, cpsrvd, and Exim to the patched versions. The update takes 5-15 minutes depending on server speed.

Step 3: Verify the Patch Applied

# Check cPanel build
cat /usr/local/cpanel/version
# Should show 11.118.0.71 or higher

# Verify SQL mode handling is patched
# There is no direct CLI check - the fix is in the database rename code.
# But you can verify Exim:
exim -bV | head -1
# Should show "Exim version 4.99.5"

# Verify cpsrvd keepalives are re-enabled (if you applied the workaround)
grep cpsrvd_keepalives_disabled /var/cpanel/cpanel.config
# Remove the line or set to 0 if you disabled it temporarily

Step 4: Restart Services

/scripts/restartsrv_cpsrvd
/scripts/restartsrv_mysql
/scripts/buildeximconf
/scripts/restartsrv_exim

Step 5: Audit for Compromise

The database rename attack leaves forensic traces. Check for recently renamed databases:

# Look for databases renamed in the last 30 days
find /var/lib/mysql -name 'db.opt' -mtime -30 -exec dirname {} \; | sort -u

# Check for suspicious triggers or stored procedures with DEFINER clauses
mysql -e "SELECT TRIGGER_SCHEMA, TRIGGER_NAME, DEFINER FROM information_schema.TRIGGERS WHERE DEFINER NOT IN ('root@localhost', 'cpanel@localhost') AND CREATED > DATE_SUB(NOW(), INTERVAL 30 DAY);"

# Check for files written to disk via OUTFILE (if secure_file_priv is empty)
find /tmp /var/tmp /dev/shm -name '*.txt' -user mysql -mtime -30 2>/dev/null

What the CVE Records Disagree On

The CNA (HackerOne) classifies CVE-2026-58048 as CWE-89 (SQL injection). cPanel's advisory calls it a privilege escalation and does not use the words "SQL injection." Both are true: database rename causes SQL to execute in root context (privilege escalation) because SQL mode is not preserved (the mechanism - which the CNA calls injection and cPanel calls a missing mode preservation).

The advisory and CVE record do not identify the injected input, the affected SQL mode, or the exact payload. Nor do they say whether Team User sub-accounts (the role-limited logins a cPanel account owner can create) meet the "authenticated account holder" requirement if those sub-accounts hold database access.

For practical purposes: if a user on your server has database access, assume they can reach CVE-2026-58048. Patch accordingly.

How ServerGurus Handles This

All ServerGurus-managed cPanel servers were updated to the August builds within 4 hours of the advisory release:

• cPanel build 11.118.0.71 applied
• Exim 4.99.5 deployed with both fixes
• Database rename audit completed - no exploitation found on any managed server
• cpsrvd keepalive workaround considered but not applied (patches were immediate)

Self-managed cPanel customers: run /usr/local/cpanel/scripts/upcp --force now. If you need assistance, open a support ticket with subject "cPanel August 2026 CVE-2026-58048."

Quick Checklist

• Verify: cat /usr/local/cpanel/version - must be 11.118.0.71+ or 11.119.0.23+
• Run /usr/local/cpanel/scripts/upcp --force
• Verify Exim 4.99.5: exim -bV | head -1
• If patching delayed: revoke MySQL features from untrusted users
• If patching delayed: set cpsrvd_keepalives_disabled=1 for CVE-2026-58047
• Audit: check for recently renamed databases and suspicious triggers
• Restart cpsrvd, MySQL, and Exim
• If you applied keepalive workaround: remove it after patching