New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

Summary

cPanel patched CVE-2026-58048, a critical flaw allowing hosting customers to execute SQL as database root. This vulnerability, with a CVSS score of 9.4, affects all supported cPanel & WHM versions and WP Squared. Two other vulnerabilities, CVE-2026-58047 (HTTP request smuggling) and a flaw in Exim, were also addressed.

Key Takeaways

1. cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity.
2. The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects all supported versions of cPanel & WHM, along with WP Squared.
3. Two more in the same build CVE-2026-58047 (CVSS 4.0 score: 5.6) is an HTTP request-smuggling issue in cpsrvd, the daemon that serves the cPanel and WHM interfaces.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about security vulnerabilities, including CVE numbers and CVSS scores, which lend it credibility. It also cites specific builds and advisories from cPanel and Exim. However, the reliance on information from advisories and the potential for outdated information due to the nature of security reporting slightly temper the score.

Bias assessment: Technical Reporting. The article focuses on the technical aspects of security vulnerabilities and their patches. It avoids sensationalism and presents information factually, with a neutral tone. The primary goal is to inform about security risks and solutions.

Note: This article details critical security vulnerabilities. Ensure your systems are updated to the patched versions or apply recommended workarounds immediately.

Credibility flag: Technical Security Alert

Claimed Facts (7)

• This is a direct statement of a security patch and its function.
• This provides a specific CVE identifier, its severity score, and the affected software.
• This lists the specific software versions that have been patched.
• This offers a practical, albeit temporary, solution for administrators.
• This identifies another vulnerability with its CVE and description.
• This introduces a third distinct security issue related to Exim.
• This details another specific fix within the Exim update.

Opinions (5)

• This statement presents a potential consequence that is conditional and not a guaranteed outcome.
• This is an interpretation of what a 'Critical' rating signifies in this context.
• This is an analytical statement about the implications of the vulnerability's reach, offering a perspective on its practical impact.
• This is a subjective observation about the complexity of account security and ownership.
• This is an interpretive statement about the limitations of a specific rating in relation to overall impact.

Claims (5)

• This highlights a discrepancy in terminology between different sources, suggesting a potential for misrepresentation or differing interpretations of the same issue.
• This points out a conflicting classification of the vulnerability, raising questions about the precise nature of the flaw.
• The lack of specific details in official advisories can be seen as a gap in information, making it harder to fully assess the vulnerability.
• This points out an ambiguity in the scope of the vulnerability's exploitability, leaving a question about who exactly can be affected.
• This statement, attributed to Exim's advisories, is unusual and potentially refers to AI-generated code or training data, which is a novel and less verifiable source for security fixes.

Key Sources

• The Hacker News — Media
• Swati Khandelwal — Author
• CISA — Cybersecurity and Infrastructure Security Agency
• cPanel — Software Vendor
• WHM — Software
• WP Squared — Software
• Exim — Software