New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

A critical flaw in cPanel has been patched, which previously allowed an authenticated hosting customer to execute SQL commands with database root privileges. This vulnerability crossed the privilege boundary between a cPanel account and the server's administrative database identity. The issue is tracked as CVE-2026-58048 with a CVSS score of 9.4, indicating a high severity. The patch was released as part of a targeted security update that also addressed two other issues related to account boundaries. The vulnerability affected cPanel, although the specific versions or configurations impacted are not specified. The fix prevents hosting customers from gaining unauthorized access to the database.