A routine database-rename operation in cPanel and WHM was quietly executing SQL as root the entire time, turning an ordinary hosting feature into a path from limited database access to full administrative control.
What Happened
cPanel disclosed CVE-2026-58048, a critical privilege-escalation flaw (CVSS 9.4) affecting all supported versions of cPanel and WHM plus WP Squared. According to cPanel’s advisory, the root cause is that SQL mode is not preserved when a database is renamed, causing SQL to execute in root context instead of the requesting user’s own permissions. Any authenticated cPanel account holder with MySQL or MariaDB feature access, a routine grant on shared and reseller hosting, could exploit the flaw to run arbitrary database commands with full administrative privileges. Researcher Vincent55 Yang is credited with the discovery. cPanel has shipped fixed builds across its supported version lines, and recommends revoking MySQL feature access from cPanel users as a temporary mitigation for anyone who cannot patch immediately.
Why It Matters
Database rename operations are the kind of low-scrutiny administrative feature that rarely shows up in a threat model, which is exactly why a SQL-mode preservation bug in it is dangerous: it needs no exploit chain, no memory corruption, just an account with a permission grant hosting providers assign by default.
The Original Insight
This flaw sits in the same class of risk CyberTech flagged in a recent Rails Active Storage flaw: an everyday, low-privilege workflow silently operating with root-level permissions underneath it. For hosting providers and MSPs running multi-tenant cPanel environments, the practical fix is not just patching, it is auditing which tenants currently hold MySQL feature access at all, since that grant is now a direct privilege-escalation path until every server is updated.
Source: cPanel
