CVE-2026-58048 “Database Privilege Escalation” is making the rounds.  If you haven’t seen it, be advised your cPanel is probably vulnerable.  It affects at least all supported versions.

The impact:

An authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges. Depending on the operating system and database engine configuration, this may extend to operating-system-level compromise.

In other words, if you give me an account on MySQL and give me privileges to manage my own databases (the usual setup), I can issue some commands which will let me execute commands as the MySQL root user.  If I can do that, I can just take over root and the entire MySQL instance.

Think about what that means:

• all the data stored for every WordPress or other database-backed site on that cPanel is available to the attacker
• An attacker can reset database and application passwords, so they can then login to people’s WordPress sites.
• They can also disable 2FA in WordPress because the configuration info for that is stored in the DB.
• The attacker will have some limited ability to interact with the OS itself, because from MySQL you can do things like create files, etc.

The good news is that someone has to have an account already.  So it’s not like an outside hacker can come in and take over your MySQL.  The bad news is that if you have cPanel, you’re quite likely a public shared hosting provider, so having a random person on the Internet get an account is what you’re all about.  No bueno for sure.

But the interesting thing is that there is no corresponding MySQL vulnerability.  Oracle, MariaDB, etc. are not saying that there’s a vulnerability where an unprivileged user on their RDBMS system can escalate to MySQL root.

So it’s something specific in the way cPanel configures and runs their MySQL.  And cPanel isn’t saying what it is – at least not yet.

What could it be?

SQL Injection to a Privileged Backend

cPanel might have something like:

grant_database_access($user, $database);

Instead of issuing a fixed command, it builds the SQL from input.  No one should ever do this, but cPanel’s perl-based architecture goes back 30 years.

Or this could be some kind of arbitrary SQL backend, like

execute_sql(...);

If the SQL is intentionally malformed (e.g., “SELECT * FROM mytable; update mysql.user set password = ‘blah’ where user = ‘root'”) then disaster could happen if this is executed as the privileged root user.

Confused Deputy

If cPanel has internal APIs like this:

create_database();
grant_privileges();
rename_database();

…then if the parameter validation is flawed, the “deputy” here could be confused into doing the wrong thing.  Or if these internal APIs don’t validate ownership and privileges themselves, they may let an attacker do something it shouldn’t be allowed to do.

Wait and See

Interestingly, the CVE doesn’t say that the attacker needs a local shell.  So quite possibly, this attack is happening purely at the database level.  In that case, the above would be stored procedures or functions.

Regardless of the cause, you need to patch your cPanel!

raindog308

raindog308 is a longtime community LETizen, technical writer, and self-described techno polymath. With deep roots in the *nix world, he has a passion for systems both modern and vintage, ranging from Unix, Perl, Python, and Golang to shell scripting and mainframe-era operating systems like MVS. He’s equally comfortable with relational database systems, having spent years working with Oracle, PostgreSQL, and MySQL.

As an avid user of LowEndBox providers, raindog308 runs an empire of LEBs, from tiny boxes for VPNs, to mid-sized instances for application hosting, and heavyweight servers for data storage and complex databases. He brings both technical rigor and real-world experience to every piece he writes.

Beyond the command line, raindog308 has a life-long love of German Shepherd Dogs, high-quality knives, target shooting, theology, tabletop RPGs, playing guitar, and hiking in deep, quiet forests.

His goal with every article is to help users, from beginners to seasoned sysadmins, get more value, performance, and enjoyment out of their infrastructure.

You can find him daily in the forums at LowEndTalk under the handle @raindog308.