Notifications
Clear all
Topic starter
20/08/2026 6:05 pm
TL;DR: CVE-2026-48172 turns a shared-hosting control path into a tenant-to-root escalation route, with LiteSpeed's cPanel plugin 2.3 through 2.4.4 and related releases exposed to active exploitation, according to Corgea. The issue shows how NHI-like service boundaries collapse when user-facing admin workflows can trigger privileged backend execution.
NHIMG editorial — based on content published by Corgea covering CVE-2026-48172 in the LiteSpeed cPanel plugin
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when a tenant-facing admin function can reach root privileges?
A: The security model breaks because the interface no longer matches the privilege boundary.
Q: Why do shared-hosting control planes create outsized privilege risk?
A: They centralise many customers, services, and secrets behind one administrative layer, so a single compromised account can affect far more than its own workload.
Q: How do security teams know whether a control-plane auth flaw was exploited before patching?
A: They look for evidence of administrative actions that should not exist, such as unexpected logins, new accounts, altered permissions, or changes to server configuration.
Practitioner guidance
- Harden tenant-to-root control paths Inventory every cPanel function that can reach privileged scripts, then separate tenant actions from root-owned management operations.
- Patch to the bundled fixed release line Upgrade to LiteSpeed WHM Plugin 5.3.1.0 or later, which bundles cPanel plugin 2.4.7 or later.
- Scan for exploitation evidence in control-plane logs Search host logs for cpanel_jsonapi_func=redisAble and correlate any matches with source IPs, file creation, SSH key changes, and root cron activity near the request time.
What's in the full analysis
Corgea's full analysis covers the operational detail this post intentionally leaves for the source:
- Log-search and correlation workflow for identifying `cpanel_jsonapi_func=redisAble` activity across affected hosts
- Vendor remediation notes for the fixed LiteSpeed release line and bundled plugin versions
- Indicators of compromise to review after suspected root-level exposure, including cron jobs, SSH keys, and web-root changes
- Release-path context and advisory references that help administrators validate exposure across LiteSpeed deployments
👉 Read Corgea's analysis of CVE-2026-48172 in the LiteSpeed cPanel plugin →
CVE-2026-48172 in LiteSpeed cPanel plugin: where did tenant boundary fail?
Explore further
20/08/2026 6:40 pm
Tenant-to-root escalation is an identity governance failure, not just a software bug. The vulnerable workflow allowed a low-trust cPanel user to trigger privileged host actions, which means the issue sits squarely in access design. That is the same governance failure pattern NHIs create when a narrowly scoped principal is allowed to reach powerful backend functions. The practical lesson is that identity boundaries must be enforced at the control-plane layer, not assumed from the user interface.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
A question worth separating out:
Q: Who is accountable when a shared host privilege boundary collapses?
A: Accountability usually spans the platform operator, the security team, and the administrators who own access policy and patch execution. In regulated environments, the question is whether delegated administration, audit logging, and privileged access review were strong enough to prevent or contain the escalation. That makes governance evidence as important as technical remediation.
👉 Read our full editorial: LiteSpeed cPanel plugin CVE-2026-48172 exposes tenant-to-root risk
