Brief Summary: CVE-2026-32992 — Disabled SSL Verification in cPanel DNS Cluster Enables Credential Interception

Introduction

Because SSL verification was disabled in cPanel's DNS Cluster system, anyone with a network position between cluster nodes could intercept the credentials in every zone synchronization request. cPanel and WHM together power infrastructure behind 60 million domains and 27 million users worldwide. For the hosting providers that run them, this flaw (CVE-2026-32992, CVSS 8.2) undermined the trust model that protects DNS cluster communications.

Technical Information

Root Cause: Improper Certificate Validation (CWE-295)

The vulnerability falls under CWE-295, Improper Certificate Validation. When a product does not validate a certificate, or validates it incorrectly, it compromises the integrity and authentication of the connection. In this case, the DNS Cluster system did not fully enforce SSL verification in its outbound requests.

A DNS cluster in cPanel is a group of nameservers that share records, so administrators can physically separate the nameservers that handle DNS requests from the web servers that host content. In a typical deployment, DNS changes are made on the WHM web server and propagate automatically to DNSOnly servers, which are the authoritative nameservers for all domains on the web servers. This synchronization requires authenticated communication between nodes.

With SSL verification disabled, the requesting server would accept any certificate the remote endpoint presented, including a fraudulent one. The product might connect to a malicious host while believing it is a trusted host, or it might be deceived into accepting spoofed data that appears to come from a trusted host. This breaks the secure boundary between cluster nodes and exposes the administrative credentials used for synchronization.

Attack Flow

An attacker would exploit this vulnerability in five steps:

1. The attacker gains a network position between two DNS Cluster nodes, for example through ARP spoofing on a shared network segment, BGP hijacking, or compromise of an intermediate routing device. Shared hosting environments and cloud deployments where multiple tenants share network infrastructure are particularly relevant.

2. When the WHM server starts a synchronization request to a DNSOnly node, the attacker intercepts the TLS handshake and presents their own certificate.

3. Because SSL verification is disabled, the WHM server accepts the fraudulent certificate without checking the certificate chain, common name, or any other trust indicator. It establishes the TLS session with the attacker's endpoint.

4. The WHM server sends the synchronization request, authentication credentials included, to what it believes is the legitimate DNSOnly node. As the TLS termination point, the attacker sees those credentials in plaintext.

5. With valid cluster credentials, the attacker can authenticate directly to DNS Cluster nodes and potentially manipulate DNS zones, redirect traffic, or pivot further into the hosting infrastructure.

How severe the attack is depends on the network topology. Clusters whose nodes communicate across untrusted network segments (different data centers, cloud regions, or providers) face the highest risk.

Patch Information

On May 13, 2026, cPanel released patches for the improper SSL certificate validation in the DNS Cluster subsystem. The fix re-enables and properly enforces SSL/TLS certificate verification on all DNS Cluster communications, so the system validates the remote server's certificate chain before it sends sensitive data. That closes the window for credential interception through rogue or compromised intermediate servers.

cPanel coordinated the patch through HackerOne (the CNA for this CVE) and released it simultaneously across all supported cPanel and WHM branches. That points to a relatively contained code change aimed at the TLS configuration in the DNS Cluster request pipeline, not a broader architectural rework.

Patched cPanel and WHM versions (update to any of these or later):

WP Squared users get the fix in version 11.136.1.12 and higher.

All later releases on every branch also include the fix. To apply the patch, administrators should force an update:

# /scripts/upcp --force

After the update completes, confirm the installed version:

# /usr/local/cpanel/cpanel -V

Both the web servers and the DNSOnly nodes in the cluster must be updated, because a single unpatched node leaves a vulnerable link in the cluster. Detailed changelogs for each branch are on the cPanel changelog page.

Operational Checklist

1. Identify all servers running cPanel, WHM, WP Squared, and cPanel DNSOnly.
2. Run the forced update script on every identified node.
3. Capture and log the version output from every server to confirm the fleet meets the minimum patched versions listed above.
4. Check network logs for anomalous inter-server communication that might indicate attempted spoofing before the patch was applied.

Affected Systems and Versions

The vulnerability affects all cPanel and WHM installations from version 126 onward that have not been updated to the patched releases:

Any server configured to participate in a DNS Cluster is affected. Standalone cPanel installations that do not use DNS Cluster functionality are not directly exposed to this attack vector, though updating them is still advisable as a defense-in-depth measure.

Vendor Security History

The cPanel ecosystem has had other critical vulnerabilities in recent months. CVE-2026-41940, disclosed in April 2026, is a severe authentication bypass affecting all cPanel and WHM versions after 11.40. Repeated high-severity findings in core authentication and trust mechanisms suggest that security researchers are actively auditing cPanel's infrastructure components.

cPanel has been responsive. It released coordinated patches across five version branches at once and gave clear, actionable update instructions. The May 13, 2026 release fixed five CVEs in total, which points to an active cadence of maintenance and discovery.

References

• NVD: CVE-2026-32992
• cPanel Security Advisory: CVE-2026-32992
• CWE-295: Improper Certificate Validation
• cPanel Documentation: DNS Cluster
• cPanel DNS Cluster Guide
• InMotion Hosting: cPanel Security Patch Advisory, May 13, 2026
• cPanel Security Advisory: CVE-2026-41940
• cPanel on Wikipedia
• WebPros Company Information
• cPanel Changelogs