Critical cPanel flaw lets a hosting customer gain database administrator access

cPanel patched a critical flaw that lets an ordinary hosting customer escalate to full database administrator access, running SQL as the database root user. Tracked as CVE-2026-58048 with a score of 9.4, the bug is significant on shared hosting, where many customers use one database server: administrator access there can expose or alter other tenants' data, and depending on the operating system and database configuration, cPanel warns it may extend to operating-system-level compromise. cPanel is one of the most widely deployed web hosting control panels, so the flaw affects a large number of shared and reseller hosting environments. Fixes shipped across several release tiers.

Check

Update cPanel to a patched build for your release tier, prioritizing shared and reseller servers, and if you host with a provider, confirm they have applied the fix.

Affected

Providers and customers on unpatched cPanel servers (CVE-2026-58048); a hosting customer can gain database root access, reaching other tenants' data and potentially the underlying operating system on shared infrastructure.

Fix

Apply cPanel's patched builds, apply the vendor's interim mitigation where immediate updating is not possible, review database accounts and logs for unauthorized administrator use, and segment tenants where feasible.