CVE-2026-58046: Plesk XML-RPC API SQLi Vulnerability

CVE-2026-58046 Overview

CVE-2026-58046 is a blind SQL injection vulnerability in the Plesk XML-RPC API. The flaw stems from improper neutralization of user-supplied input within XML-RPC requests. A remote authenticated user with low privileges can inject arbitrary SQL statements and read data from the Plesk database. Successful exploitation leads to full compromise of the Plesk panel, including administrative takeover and access to hosted customer data. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
A low-privileged authenticated user can extract database contents and escalate to full panel compromise, exposing every account, credential, and configuration managed by Plesk.

Affected Products

Plesk (XML-RPC API component)
Plesk-hosted control panel deployments exposing XML-RPC endpoints
Downstream services managed by Plesk (mail, DNS, hosted domains)

Discovery Timeline

2026-07-30 - CVE-2026-58046 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58046

Vulnerability Analysis

The Plesk XML-RPC API accepts structured requests from authenticated users to manage hosting operations. The affected endpoint fails to properly neutralize SQL metacharacters passed inside XML-RPC parameters. Attacker-controlled input flows into a database query without parameterization, allowing SQL statement modification.

Because exploitation returns no direct output to the caller, the flaw manifests as blind SQL injection. Attackers infer data by observing timing differences or conditional response behavior. This technique lets an attacker enumerate table contents byte-by-byte, including the psa administrative schema that stores panel credentials.

The attack scope changes across trust boundaries. A low-privileged reseller or hosting customer can read data belonging to other tenants and to the administrator account, resulting in full panel takeover.

Root Cause

The root cause is missing input sanitization or parameterized query use in the XML-RPC request handler. User input is concatenated into SQL statements executed against the Plesk backend database, matching the classic [CWE-89] pattern.

Attack Vector

Exploitation requires network access to the XML-RPC endpoint and a valid low-privileged Plesk account. The attacker submits a crafted XML-RPC request containing SQL payloads in a vulnerable parameter. No user interaction is required, and the attack complexity is low. See the Plesk Security Advisory for CVE-2026-58046 for vendor-supplied technical detail.

// No verified public proof-of-concept is available.
// Refer to the Plesk Security Advisory linked above for technical details.

Detection Methods for CVE-2026-58046

Indicators of Compromise

XML-RPC POST requests to Plesk containing SQL metacharacters such as ', --, UNION, SLEEP(, or BENCHMARK( in parameter values.
Repeated authenticated XML-RPC requests from a single low-privileged account producing unusually long or variable response times consistent with time-based blind injection.
Unexpected reads or lookups against the psa database, especially against the accounts, clients, or sys_users tables.
New administrative sessions or credential changes shortly after a burst of XML-RPC traffic from a non-admin user.

Detection Strategies

Inspect Plesk panel.log and web server access logs for XML-RPC requests containing SQL syntax fragments in POST bodies.
Correlate authenticated low-privilege sessions against volume anomalies in XML-RPC calls per account.
Deploy web application firewall rules that flag SQL keywords inside XML-RPC parameter values.
Monitor database process lists for long-running or unusually structured queries originating from the Plesk backend user.

Monitoring Recommendations

Alert on any XML-RPC request pattern that repeatedly triggers timing deltas above baseline for the same endpoint.
Track authentication events for reseller and customer roles that access /api/v2 or legacy XML-RPC paths outside normal working hours.
Baseline expected XML-RPC method calls per role and alert on deviations, especially privileged method invocations from non-admin users.

How to Mitigate CVE-2026-58046

Immediate Actions Required

Apply the vendor patch referenced in the Plesk Security Advisory for CVE-2026-58046 as soon as it is available for your Plesk version.
Rotate the Plesk administrator password and all API keys after patching, since a low-privileged account could have already extracted them.
Audit all reseller and customer accounts for unauthorized privilege changes or newly created administrative users.
Review database contents accessed since the vulnerability was disclosed for signs of data exfiltration.

Patch Information

Plesk has issued guidance in its official advisory. Administrators should update to the fixed Plesk build identified in the Plesk Security Advisory for CVE-2026-58046 and verify the panel version through the Plesk UI or plesk version command.

Workarounds

Restrict network access to the Plesk XML-RPC endpoint to trusted management IP ranges using firewall or reverse proxy rules.
Disable the XML-RPC API entirely if it is not required by your automation stack until the patch is applied.
Enforce strong authentication and reduce the number of low-privileged accounts able to reach the API surface.

bash

# Example: restrict XML-RPC access to a management subnet via iptables
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP

# Verify installed Plesk version after patching
plesk version