CVE-2026-56843: Plesk XML-RPC Information Disclosure

CVE-2026-56843 Overview

CVE-2026-56843 is an incorrect authorization vulnerability in the XML-RPC API of WebPros Plesk before version 18.0.78.4. A low-privileged authenticated customer can look up domains they do not own because ownership checks are enforced only for certain lookup filters. Schema validation is also bypassed for legacy protocol versions, allowing malformed requests through. Exploitation results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext. Attackers can leverage the recovered credentials to execute code as another tenant's system user, breaking the multi-tenant isolation model of shared hosting environments.

Critical Impact
Any authenticated Plesk customer can retrieve cleartext FTP passwords belonging to other tenants and pivot to code execution as those tenants' system users.

Affected Products

WebPros Plesk versions prior to 18.0.78.4
Plesk XML-RPC API endpoint
Shared hosting environments with multiple tenants provisioned on the same Plesk installation

Discovery Timeline

2026-07-08 - CVE-2026-56843 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56843

Vulnerability Analysis

The vulnerability resides in the XML-RPC API used for programmatic administration of Plesk objects. The API exposes domain lookup operations that accept multiple filter types. Ownership enforcement is implemented per filter, and only a subset of filters validate that the requesting customer owns the target domain. An authenticated customer who selects an unprotected filter bypasses the tenant boundary and enumerates domains hosted by other customers on the same server.

A second flaw compounds the issue. Schema validation for XML-RPC requests is skipped when the client declares a legacy protocol version. Malformed or unexpected request structures are accepted without rejection, expanding the attack surface for the authorization gap. Once cross-tenant domain lookups succeed, the response includes FTP account details. Plesk stores FTP passwords in cleartext, so the recovered credentials are immediately usable. This is classified as insufficiently protected credentials [CWE-522].

Root Cause

Ownership validation is applied inconsistently across XML-RPC lookup filters instead of being enforced by a single authorization layer. Combined with schema validation being disabled for legacy protocol versions, low-privileged customers reach code paths that were intended only for administrators.

Attack Vector

Exploitation requires network access to the Plesk XML-RPC endpoint and a valid low-privileged customer account. The attacker sends a crafted XML-RPC request using a legacy protocol version and a lookup filter that lacks ownership checks. The response returns another tenant's domain configuration, including cleartext FTP credentials. The attacker authenticates over FTP as the victim tenant and uploads files that execute as that tenant's system user. Refer to the Plesk Security Advisory for technical details.

Detection Methods for CVE-2026-56843

Indicators of Compromise

XML-RPC requests from customer accounts targeting the domain lookup API with legacy protocol version headers
Successful XML-RPC responses containing FTP credentials for domains outside the requesting account's ownership scope
FTP login events for a domain's system user originating from IP addresses not previously seen for that tenant

Detection Strategies

Audit Plesk XML-RPC access logs for lookup calls that return records for domains not owned by the calling customer
Alert on XML-RPC requests declaring legacy protocol versions, particularly when originating from non-administrator accounts
Correlate FTP authentication events with tenant ownership records to surface cross-tenant credential reuse

Monitoring Recommendations

Enable verbose logging on the Plesk API layer and forward events to a central SIEM for retention and correlation
Monitor process execution under tenant system users for unexpected shells, interpreters, or outbound network activity
Track file uploads to web-accessible directories following FTP authentication events

How to Mitigate CVE-2026-56843

Immediate Actions Required

Upgrade Plesk to version 18.0.78.4 or later on all managed servers
Rotate FTP passwords for every tenant account after patching, treating existing credentials as compromised
Review XML-RPC access logs for the retention window to identify potential prior exploitation

Patch Information

WebPros has released Plesk 18.0.78.4 which corrects the authorization checks across all XML-RPC lookup filters and enforces schema validation regardless of declared protocol version. Installation details are provided in the Plesk Security Advisory.

Workarounds

Restrict network access to the Plesk XML-RPC endpoint using firewall rules that permit only trusted administrator IP addresses
Disable the XML-RPC interface where it is not required for automation or third-party integrations
Enforce SFTP in place of cleartext FTP and disable FTP protocol access for tenant accounts where possible

bash

# Restrict Plesk XML-RPC API to trusted management network
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP

# Verify installed Plesk version
plesk version