CVE-2026-29203: cPanel Nova Plugin Privilege Escalation

CVE-2026-29203 Overview

CVE-2026-29203 is a symlink-following vulnerability [CWE-61] in the cPanel Nova plugin. The Cpanel::Nova::Connector module performs a chmod call that follows symbolic links without validation. An authenticated cPanel user can place a symlink at a user-controlled legacy Nova path inside their home directory. The chmod operation then applies root-owned permission changes to the symlink target. This allows the attacker to modify permissions on arbitrary system files or directories, leading to denial of service or local privilege escalation on the host.

Critical Impact

Authenticated cPanel users can alter permissions on arbitrary files as root, enabling local privilege escalation or service disruption on shared hosting servers.

Affected Products

• cPanel & WHM with the Nova plugin (WP2 release channel)
• Servers using the Cpanel::Nova::Connector legacy path handling
• Multi-tenant shared hosting deployments running cPanel

Discovery Timeline

• 2026-05-08 - cPanel publishes Security Advisory CVE-2026-29203
• 2026-05-08 - CVE-2026-29203 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-29203

Vulnerability Analysis

The flaw resides in the cPanel Nova plugin's Cpanel::Nova::Connector component. The connector invokes a chmod operation against a legacy Nova path located beneath the authenticated user's home directory. Because chmod follows symbolic links by default on Linux, the call resolves to whatever target the symlink points to. The operation runs with elevated privileges, so the resulting permission change is applied as root. This is a classic symlink-following weakness [CWE-61] where a privileged process trusts a file path that an unprivileged user controls.

Root Cause

The root cause is missing symlink validation before invoking chmod. The connector code does not verify that the target path is a regular file or directory, nor does it check ownership before modifying permissions. The user-controlled location of the legacy Nova path inside $HOME allows the attacker to substitute a symlink pointing to any path on the filesystem.

Attack Vector

An authenticated cPanel user logs into their account and creates a symbolic link at the expected legacy Nova path within their home directory. The symlink points to a sensitive target such as /etc/shadow, a setuid binary, a service configuration file, or a system directory. The user then triggers the cPanel Nova plugin workflow that invokes Cpanel::Nova::Connector. The privileged process performs chmod on the symlink, modifying the permissions of the target. The attacker can subsequently read protected files, replace binaries, or disrupt services.

No verified public exploit code is available. See the cPanel Security Advisory CVE-2026-29203 for vendor details.

Detection Methods for CVE-2026-29203

Indicators of Compromise

• Symbolic links present at legacy Nova paths beneath cPanel user home directories pointing outside the user's home tree.
• Unexpected permission changes on system files such as /etc/shadow, /etc/passwd, or files under /usr/bin and /usr/sbin.
• Audit log entries showing chmod operations by the cPanel Nova plugin against paths outside /home.

Detection Strategies

• Audit cPanel user home directories for symlinks targeting paths outside the user's own home tree, focusing on legacy Nova plugin paths.
• Enable Linux auditd rules for chmod, fchmodat, and chown syscalls invoked by cPanel processes and review for unexpected targets.
• Compare current permissions of sensitive system files against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

• Forward auditd and cPanel plugin logs to a centralized SIEM and alert on permission changes affecting paths outside user home directories.
• Monitor for creation of symlinks in user-writable locations that resolve to root-owned system paths.
• Track invocations of Cpanel::Nova::Connector and correlate them with subsequent filesystem permission changes.

How to Mitigate CVE-2026-29203

Immediate Actions Required

• Apply the cPanel & WHM WP2 Security Update dated May 08, 2026, as described in the vendor advisory.
• Restrict access to cPanel accounts on shared hosting servers and review accounts for suspicious symlinks under legacy Nova paths.
• Restore correct permissions on any system files showing unauthorized changes and investigate the responsible account.

Patch Information

cPanel addressed CVE-2026-29203 in the WP2 Security Update released on May 08, 2026. Refer to the cPanel Security Advisory CVE-2026-29203 for fixed version details and upgrade instructions.

Workarounds

• Disable the cPanel Nova plugin until the patch can be deployed if business requirements permit.
• Mount user home filesystems with options that limit symlink abuse where supported, and enable the kernel fs.protected_symlinks sysctl to reduce symlink-following risk for privileged processes.
• Audit and remove pre-existing symlinks at known legacy Nova paths within all cPanel user home directories before applying the patch.

# Enable kernel symlink protection to reduce exposure
sysctl -w fs.protected_symlinks=1
echo 'fs.protected_symlinks=1' >> /etc/sysctl.d/99-symlink-protection.conf

# Locate suspicious symlinks under cPanel home directories
find /home -xdev -type l -lname '/*' -not -lname '/home/*' -ls