CVE-2026-32992: DNS Cluster SSL Info Disclosure Flaw

CVE-2026-32992 Overview

CVE-2026-32992 affects the cPanel & WHM DNS Cluster system, where SSL/TLS certificate verification is disabled by default during cluster communications. A network-positioned attacker can intercept DNS cluster requests, present a fraudulent certificate, and capture authentication credentials transmitted between cluster nodes. The flaw is categorized under CWE-295: Improper Certificate Validation.

The vulnerability requires no authentication and can be exploited over the network. Successful exploitation exposes high-value cluster credentials that an attacker can reuse to manipulate DNS records across the affected infrastructure.

Critical Impact
A man-in-the-middle attacker can intercept DNS Cluster traffic and harvest credentials, enabling unauthorized DNS record manipulation across linked cPanel servers.

Affected Products

cPanel & WHM (WP2 Security Update branch)
DNS Cluster system component
Refer to the cPanel Security Update advisory for specific affected builds

Discovery Timeline

2026-05-13 - cPanel publishes security update advisory for CVE-2026-32992
2026-05-13 - CVE-2026-32992 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-32992

Vulnerability Analysis

The cPanel DNS Cluster feature allows multiple cPanel & WHM servers to share DNS zone data. Cluster nodes communicate over HTTPS using API tokens or remote access keys for authentication. CVE-2026-32992 stems from the cluster client establishing TLS connections without validating the remote server's certificate.

When SSL verification is disabled, the client accepts any certificate presented by the remote peer. An attacker on the network path between two cluster nodes can present a self-signed or attacker-controlled certificate. The cluster client completes the TLS handshake and transmits authentication credentials inside the encrypted channel, which the attacker decrypts in real time.

The vulnerability is exploitable from any network position that can intercept traffic between cluster members. This includes upstream ISPs, compromised routers, BGP hijack scenarios, and ARP-spoofing on shared network segments.

Root Cause

The DNS Cluster system initiates outbound HTTPS requests with certificate validation disabled in the underlying HTTP client. The client neither verifies the certificate chain against a trusted root nor checks the certificate's common name against the expected hostname. This violates the secure-by-default principle for TLS clients described in [CWE-295].

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker positions themselves between two DNS cluster peers, presents a fraudulent TLS certificate, and proxies traffic to capture cluster credentials. Once credentials are captured, the attacker can authenticate directly to the cPanel WHM API and modify DNS records, redirect domains, or escalate access across the cluster.

No public proof-of-concept code is available for this vulnerability. Refer to the cPanel Security Update advisory for vendor technical details.

Detection Methods for CVE-2026-32992

Indicators of Compromise

Unexpected TLS certificates presented by peer DNS cluster nodes that do not match previously observed fingerprints
DNS zone modifications on cluster members that do not correlate with authenticated administrator sessions in WHM logs
Outbound DNS cluster API connections to IP addresses that differ from configured peer addresses

Detection Strategies

Capture and inspect TLS handshakes on DNS cluster ports to identify certificate mismatches or self-signed certificates presented to cluster clients
Compare DNS zone serial numbers and record changes across cluster members for unauthorized modifications
Review WHM access logs for cluster API calls originating from unexpected source IP addresses

Monitoring Recommendations

Enable verbose logging on the cPanel DNS Cluster subsystem and forward logs to a centralized SIEM for correlation
Monitor ARP tables and routing changes on network segments that carry cluster traffic to identify man-in-the-middle staging
Alert on any deviation in TLS certificate fingerprints observed between cluster peers across scheduled health checks

How to Mitigate CVE-2026-32992

Immediate Actions Required

Apply the cPanel & WHM security update referenced in the May 13, 2026 advisory to all cluster members
Rotate all DNS cluster remote access keys and API tokens after patching, treating existing credentials as potentially exposed
Audit DNS zone records across cluster nodes for unauthorized modifications since the cluster was deployed

Patch Information

cPanel released a fixed build alongside the WP2 Security Update on May 13, 2026. The patch enables SSL certificate verification by default for DNS cluster communications. Administrators should consult the vendor advisory for the specific version numbers that resolve CVE-2026-32992 and update all cluster peers to the same patched build.

Workarounds

Restrict DNS cluster traffic to a dedicated management network or VPN tunnel that an external attacker cannot reach
Use firewall rules to limit inbound and outbound cluster API access to known peer IP addresses only
If patching is delayed, temporarily disable the DNS Cluster feature and manage zones individually until the update is applied