CVE-2026-58048

cPanel's database rename operation fails to preserve SQL mode settings during the rename, creating a security context loss that can drop critical database protections like NO_UNSIGNED_SUBTRACTION and ANSI_QUOTES. The operation executes in root context—meaning it runs at the highest privilege tier available to the hosting platform—which compounds the risk significantly. The CVSS 9.4 score paired with a low EPSS probability (0.00561) reflects a narrow but high-consequence vulnerability. Exploitation requires authenticated administrator access to cPanel, which constrains the attack surface but creates severe downstream risk: a successful rename can pivot into broader cPanel infrastructure compromise, affecting every site, email account, and DNS record the panel manages. If an attacker has already compromised admin credentials through other means, this becomes a pivot vector rather than an initial access vector—making the EPSS probability somewhat misleading for post-auth threat models. The root context execution detail is the most critical technical finding. This is not simple privilege escalation within the database—it is execution at the hosting platform's highest permission tier. Two possibilities exist: either the rename operation explicitly elevates to root for its duration, or it inherits ambient root-level privileges by default and merely fails to remediate them. Either case represents a fundamental security model failure in how administrative operations handle privilege boundaries. For defenders, prioritize these actions: first, apply the cPanel patch immediately—this is a known failure mode in database administrative tooling, not an edge case. Second, audit your environment for databases that may have been renamed while sql_mode protections were stripped; check current sql_mode settings against your baseline expectations. Third, review other cPanel database operations (cloning, migration, backup restore) for similar context-handoff failures—these administrative corridors are systematically under-audited. Fourth, assume that any admin credential compromise creates exposure to this vulnerability and treat accordingly in your threat model. This is not an isolated bug. The pattern of administrative operations silently dropping SQL mode constraints has appeared repeatedly across the MySQL ecosystem for fifteen years. The structural cause is treating configuration state (sql_mode, character sets, collation) as separate from security boundaries—when tooling optimizes for operational convenience, these configurations are the first casualties. Expect similar issues in other control panels and hosting automation tools.

Reviewed through automated stages and approved by a human before publication.