cPanel Patches Critical Root Escalation Flaw in EmailTrack

cPanel has released critical security updates to address a vulnerability in its EmailTrack functionality that allows low-privileged users to gain root access. The flaw, tracked as CVE-2026-67401, represents a significant breach of tenant isolation in shared hosting environments.

The vulnerability is a critical SQL injection flaw. According to a cPanel security advisory, an authenticated account holder with mail-related privileges can exploit the bug to create arbitrary files on the server. Once these files are placed, the attacker can leverage them to execute code as the root user. The advisory explicitly warns that successful exploitation gives an attacker "full control of the server."

The Risk to Shared Hosting

cPanel and WHM are among the most widely deployed web hosting control panels globally, designed to simplify server management for both providers and end users. In typical shared hosting configurations, dozens or hundreds of separate customers—tenants—reside on a single physical or virtual machine.

Security in these environments relies entirely on strict isolation, ensuring that one user cannot access the files, databases, or processes of another. When a privilege escalation vulnerability like CVE-2026-67401 occurs, that isolation is completely bypassed. The ability for a single tenant to move from a restricted account to root privileges effectively collapses the security model of the entire host.

Industry Implications

The consequences of this flaw are severe for hosting providers. A malicious customer or an attacker who has compromised a single low-level account could steal sensitive data from every other tenant on the server. Beyond data theft, root access allows for the installation of persistent backdoors, the manipulation of server-wide configurations, and the potential use of the infrastructure for wider attacks.

Because the flaw affects all supported versions of cPanel and WHM, the attack surface was vast, leaving a significant portion of the web hosting market vulnerable until the patch was applied.

Remediation and Next Steps

cPanel has released patches across multiple version branches to resolve the issue. Administrators are urged to update to the following versions immediately: v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, or WP2 v11.138.1.9.

Server administrators should verify their current version and apply these updates to prevent unauthorized root access. While cPanel has addressed the specific SQL injection point, the incident highlights the ongoing risk associated with complex control panel functionalities that interact with high-level system privileges.