CVE-2026-67401-cPanel-EmailTrack-SQLi

Read-only IOC scanner and mitigation toolkit for cPanel & WHM EmailTrack SQL injection (CVE-2026-67401). Performs version fingerprinting, file integrity checks, log triage, and provides hardening guidance for defenders.

As of the last update to this repository, CVE-2026-67401 is a newly-assigned CVE with no publicly confirmed technical write-up, no published exploitation primitives, and no known public proof-of-concept. cPanel/WebPros discloses full technical detail for its vulnerabilities only after a Technical Security Release (TSR) ships, specifically to prevent pre-patch exploitation — so authoritative low-level detail (exact injection point, exact patched build numbers) may not yet be publicly available at the time you are reading this.

This repository intentionally does NOT contain a working SQL injection payload or exploit chain. It focuses on what defenders actually need on day zero of a disclosure:

• Version/patch-level fingerprinting
• Indicator-of-Compromise (IOC) scanning based on the disclosed impact of the bug (unauthorized file creation, SQL injection through the EmailTrack feature, root-level code execution)
• Log and file-integrity triage
• Hardening and mitigation guidance

Once cPanel publishes the full advisory and a patched build number, set PATCHED_BUILD in scripts/cve-2026-67401-ioc-scan.sh (or pass --patched-build) and re-run the scanner across your fleet for an accurate patch-status result.

1. Vulnerability Summary

Suggested GitHub Topics for This Repository

cve cve-2026-67401 cpanel whm sql-injection sqli rce web-hosting-security ioc incident-response vulnerability-scanner security-advisory blue-team compromise-assessment cpanel-security

Plain-English Description

CVE-2026-67401 is a SQL injection vulnerability in cPanel & WHM's EmailTrack functionality — the subsystem that logs and reports on outbound/inbound email delivery. According to the vendor advisory summary reported by security researchers, an authenticated cPanel account holder who has mail-related privileges (i.e., any ordinary hosting customer with email enabled — not an administrator) can supply crafted input that is unsafely concatenated into a SQL query executed by EmailTrack's backend.

Because the resulting SQL injection allows the attacker to manipulate backend database operations, it can be abused to create arbitrary files on the server. Since certain EmailTrack/cPanel database and file-writing operations run in a privileged context, the attacker-controlled file write can be leveraged to achieve code execution as the root user — turning a low-privilege hosting account into a full root compromise of the shared server.

This pattern (SQLi → INTO OUTFILE-style arbitrary file write → privileged code execution) is a classic "SQLi-to-RCE" escalation chain and is especially severe on shared hosting environments, where hundreds or thousands of unrelated customer accounts run on the same physical/virtual host — meaning a single low-privilege, mail-enabled customer account anywhere on the box is enough to compromise every tenant on that server.

Why This Matters

• cPanel & WHM powers a very large share of the web hosting industry — estimates commonly cited by researchers put usage in the millions of servers / tens of millions of domains.
• The bug requires only a low-privilege, mail-enabled cPanel account — the kind sold to ordinary customers on shared/reseller hosting — not a WHM or root account. This dramatically lowers the bar for exploitation on multi-tenant hosts (malicious "customer," compromised low-value customer account, etc.).
• The end state is root on the box, meaning every other tenant, every database, every mailbox, and the hosting provider's control-plane trust boundary is at risk.
• Shared hosting compromises of this type have historically been used for mass web-shell deployment, ransomware staging, credential theft, and further pivoting into hosting-provider infrastructure.

2. Affected Versions & Patch Status

cPanel ships fixes through Technical Security Releases (TSRs). Exact build numbers for CVE-2026-67401 should be confirmed against the official cPanel security advisory before you rely on any number here — vendor-published build numbers are the only authoritative source.

Action: Check your installed build with:

...and compare it against the fixed build listed on cPanel's official security advisories page (linked below). This repo's scanner (scripts/cve-2026-67401-ioc-scan.sh) automates this check — just fill in the patched build number once cPanel publishes it.

3. Quick Start — Run the IOC Scanner

The scanner is read-only — it does not modify configuration, does not attempt exploitation, and does not require internet access. It writes a timestamped report to /root/cve-2026-67401-ioc-report-<timestamp>.txt (and JSON if python3 is available).

See docs/DETECTION.md for what each check does and how to interpret results, and docs/REMEDIATION.md for patching and hardening steps.

Stopgap mitigation (if patching must wait)

This does not fix the underlying flaw — it reduces exposure by removing the EmailTrack feature from customer-facing feature lists until the official patch can be applied. See docs/REMEDIATION.md for details and rollback steps.

4. What the Scanner Checks

1. Version/patch-level fingerprinting — installed cPanel & WHM build vs. known-vulnerable/patched ranges (configurable).
2. cPanel RPM/package integrity — rpm -Va-style verification to flag unexpected modifications to cPanel binaries and Perl/CGI modules.
3. Suspicious newly-created root-owned files — scans common web/mail-writable paths for recently created files owned by root (the disclosed impact of this bug is unauthorized arbitrary file creation).
4. MySQL/MariaDB log triage — if the general/slow query log is enabled, greps for classic SQLi and file-write markers (INTO OUTFILE, INTO DUMPFILE, UNION SELECT, LOAD_FILE, stacked queries) in proximity to EmailTrack-related tables/queries.
5. cPanel/Exim/Apache log triage — flags unusual request patterns to email-tracking-related endpoints and unexpected 5xx/500 spikes that can correlate with injection attempts.
6. Unexpected privileged processes / cron / SUID changes — a generic "did something escalate to root recently" sweep, useful for any SQLi→RCE-class bug, not just this one.
7. New/unexpected WHM & cPanel accounts, and accounts with unexpected mail privileges.

These are general-purpose compromise-assessment heuristics built around the publicly disclosed impact of the bug (arbitrary file creation via SQL injection in EmailTrack, escalating to root). They are not a guarantee of detection or non-detection — treat a clean scan as "no obvious indicators found," not as proof the host is unaffected.

5. Remediation Priority Order

1. Patch immediately. Update cPanel & WHM to the fixed build referenced in the official advisory (WHM ≫ Software ≫ Update Preferences or /scripts/upcp from the CLI).
2. If you cannot patch immediately: restrict which accounts have mail-related privileges, and consider firewalling the WHM/cPanel management ports (2082/2083/2086/2087) from untrusted networks.
3. Audit all mail-enabled accounts on affected hosts — this bug is exploitable by any account with mail privileges, so treat every hosting customer as a potential (even unwitting/compromised) attacker vector until patched.
4. Run the IOC scanner in this repo on every host that was running a vulnerable build, even after patching, to rule out pre-patch compromise.
5. Apply the stopgap mitigation (scripts/cve-2026-67401-mitigation.sh) on any host that cannot be patched within the same day — it restricts the EmailTrack feature via WHM Feature Manager so mail-privileged accounts can no longer reach the vulnerable code path.
6. Rotate credentials and re-image if IOCs are found — SQLi-to-root chains are commonly followed by persistence (web shells, cron backdoors, SSH keys, new WHM accounts). A patch alone does not remove an existing backdoor.

Full details: docs/REMEDIATION.md

6. Repository Structure

7. Related cPanel & WHM Vulnerabilities (2026)

CVE-2026-67401 is one of several cPanel & WHM security issues disclosed in 2026. If you're hardening a cPanel fleet, patch against all of these, not just this one:

A recurring pattern across nearly all of these: a low-privilege, authenticated cPanel feature turns into root-level compromise through insufficient input sanitization at a privilege boundary. If your fleet has been hit by any of the above, run the IOC scanner in this repo as part of a broader review — attackers who got in via one bug commonly leave persistence that outlives the specific CVE that let them in.

8. Frequently Asked Questions

Is my server affected by CVE-2026-67401? If you run cPanel & WHM and haven't yet applied the vendor's fix for this CVE, treat your server as vulnerable. Because exploitation only requires a mail-enabled customer account (not an admin account), every shared/reseller hosting box with ordinary hosting customers is in scope — this is not limited to servers with untrusted "power users."

Is there a public exploit or Metasploit module for CVE-2026-67401? Not as of the last time this repository was updated. This repository does not provide one and will not.

Does disabling email tracking fully fix the issue? No. Restricting the EmailTrack feature (see scripts/cve-2026-67401-mitigation.sh) is a stopgap that reduces exposure, not a patch. The underlying SQL injection lives in cPanel's own code and can only be fixed by installing the vendor's update once released.

My scan came back clean — am I safe? A clean IOC scan means the heuristics in this repo found no signal — it is not proof of non-compromise, especially against a targeted or careful attacker. Patch status (an exact version comparison) is far more reliable than any IOC heuristic here. Combine both.

What's the difference between this repo and a normal exploit-PoC repo? Exploit-PoC repos reproduce the vulnerability so it can be tested/fired at a target. This repo deliberately does not do that — no injection payloads, no exploitation chain — and instead gives defenders version-checking, log/file triage, and mitigation tooling.

Where do I get the authoritative, official technical details? https://sec.cpanel.net/ — cPanel's own security advisories are the only authoritative source for the exact vulnerable/patched build numbers, the CVSS vector, and the full technical root cause.

More questions answered in docs/FAQ.md.

9. Timeline

Full source-by-source timeline: docs/TIMELINE.md

10. References

• cPanel Official Security Advisories: https://sec.cpanel.net/
• cPanel & WHM Documentation: https://docs.cpanel.net/
• cPanel & WHM Update Preferences docs: https://docs.cpanel.net/whm/software/update-preferences/
• cPanel WHM API 1 — Feature Manager functions (used by the mitigation script): https://api.docs.cpanel.net/whm/apis/
• MITRE CVE Record (check for current status): https://www.cve.org/CVERecord?id=CVE-2026-67401
• NVD Record (check for current status): https://nvd.nist.gov/vuln/detail/CVE-2026-67401
• Daily CyberSecurity, "CVE-2026-67401: cPanel Flaw Grants Full Control of the Server" — https://securityonline.info/cve-2026-67401-cpanel-sql-injection-flaw/
• CISA Known Exploited Vulnerabilities Catalog (check whether this CVE is later added): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Shadowserver Foundation scan/sightings data (useful for gauging in-the-wild activity once available): https://www.shadowserver.org/

⚠️ This CVE had not yet appeared in NVD's public database with full metadata as of the last check — check the MITRE/NVD links above for the current authoritative status before acting on any specifics in this repo.

11. Disclaimer & Legal

This repository is published for defensive purposes only — patch verification, compromise assessment, and incident response on infrastructure you own or are authorized to test. It contains no exploit code, no SQL injection payloads, and no working proof-of-concept for CVE-2026-67401.

Unauthorized access to computer systems is illegal in most jurisdictions (e.g., the U.S. Computer Fraud and Abuse Act, the UK Computer Misuse Act, and equivalent laws elsewhere). Only run the tooling in this repository against systems you own or are explicitly authorized to assess.

12. Security Policy for This Repository

Found a bug in the scanner/mitigation scripts themselves (not in cPanel) — e.g., something that could cause false negatives, unsafe behavior, or unintended system changes? See SECURITY.md.

13. Contributing

Corrections, updated patched-build numbers, additional IOC signatures, and false-positive reports are welcome — open an issue using the template in .github/ISSUE_TEMPLATE/ioc-report.md or submit a pull request. Please cite sources for any technical claims. See CONTRIBUTING.md for the full guidelines.

License

MIT — see LICENSE.