CVE-2026-29202: create_user Plugin RCE Vulnerability

CVE-2026-29202 Overview

CVE-2026-29202 is a code injection vulnerability in the cPanel/WHM create_user plugin. The flaw stems from insufficient input validation of the plugin parameter, which allows authenticated users to execute arbitrary Perl code. Code runs in the context of the already authenticated account's system user, scoping impact to that user's permissions rather than root.

The weakness is classified under CWE-94: Improper Control of Generation of Code. Exploitation requires valid authentication and network access to the WHM interface. cPanel released a security update on May 8, 2026 to address the issue.

Critical Impact
Authenticated attackers can execute arbitrary Perl code as the authenticated account's system user via the plugin parameter of the create_user plugin.

Affected Products

cPanel & WHM (versions prior to the May 8, 2026 security update)
cPanel WP2 (Web Platform 2)
Systems exposing the WHM create_user plugin endpoint

Discovery Timeline

2026-05-08 - cPanel releases security patch addressing CVE-2026-29202
2026-05-08 - CVE-2026-29202 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-29202

Vulnerability Analysis

The create_user plugin in cPanel/WHM accepts a plugin parameter that is incorporated into Perl execution flow without sufficient validation. An authenticated user can supply a crafted value that is interpreted as Perl code rather than as a plugin identifier. The resulting code runs under the authenticated cPanel account's system user.

Because the attack requires low privileges and no user interaction, any compromised cPanel account becomes a pivot for arbitrary Perl execution. The blast radius is bounded by the operating system user assigned to that cPanel account, so the vulnerability does not directly grant root. It can, however, be chained with local privilege escalation flaws to broaden impact.

Root Cause

The root cause is improper control of generation of code [CWE-94]. The plugin parameter is treated as trusted input and reaches a Perl interpreter context without strict allow-listing or sanitization. Any string that satisfies the request format is accepted, including strings that encode Perl statements.

Attack Vector

The attacker authenticates to the cPanel/WHM interface, then issues a request to the create_user workflow with a malicious plugin parameter value. The server passes the value into Perl execution. The injected Perl runs with the file system and process privileges of the cPanel account's system user, enabling file read/write, command execution, and persistence within that user's scope. See the cPanel Security Update CVE-2026-29202 advisory for vendor details.

Detection Methods for CVE-2026-29202

Indicators of Compromise

Unexpected Perl processes spawned by cPanel account system users following create_user plugin invocations
Anomalous values in the plugin parameter of HTTP requests to WHM endpoints, particularly values containing Perl syntax such as system, qx, backticks, or eval
New or modified files in cPanel account home directories shortly after authenticated WHM sessions
Outbound network connections initiated by Perl processes running as cPanel users

Detection Strategies

Inspect WHM access logs for create_user requests carrying suspicious plugin parameter content
Correlate authentication events with subsequent process execution under the same system user to identify chained activity
Alert on Perl interpreter invocations that spawn shells, network utilities, or write to sensitive paths

Monitoring Recommendations

Forward cPanel/WHM access and error logs to a centralized log platform for retention and search
Baseline normal create_user parameter values to flag deviations
Monitor child processes of the cPanel web service, especially long-running or non-standard Perl scripts

How to Mitigate CVE-2026-29202

Immediate Actions Required

Apply the May 8, 2026 cPanel/WHM security update on all cPanel, WHM, and WP2 systems
Audit cPanel account access and rotate credentials for any account that may have been misused
Review system user home directories on affected servers for unauthorized files, cron entries, or scripts

Patch Information

cPanel published the fix in the cPanel Security Update CVE-2026-29202 advisory dated May 8, 2026. The update corrects input validation for the plugin parameter in the create_user plugin. Administrators on automatic update tiers receive the fix through normal upcp runs; manual installations should be updated immediately.

Workarounds

Restrict WHM access to trusted administrative IP ranges using the cPanel host access control or perimeter firewalls
Disable or remove unused reseller and account-creation privileges to reduce the population of authenticated principals that can reach the vulnerable endpoint
Enforce strong authentication, including two-factor authentication, on all WHM and cPanel accounts until patching is complete

bash

# Update cPanel/WHM to the latest patched build
/usr/local/cpanel/scripts/upcp --force

# Verify installed version after update
/usr/local/cpanel/cpanel -V