EUVD-2026-31204
GHSA-fxrh-cwjh-m33v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack runs through the cPanel end-user redisAble API implying a low-privileged hosting account (PR:L), low complexity, and escalation across scope to root (S:C) with full CIA impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. LiteSpeed WHM Plugin (the parent plugin) is unaffected. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features.
Articles & Coverage 1
AnalysisAI
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers abuse the plugin's Redis enable/disable functionality (the redisAble cpanel_jsonapi_func) to gain elevated, potentially root-level, access on the cPanel host. This flaw is confirmed actively exploited (CISA KEV) with in-the-wild activity observed in May 2026, publicly available exploit code exists (including a GitHub PoC), and the vendor scores it CVSS 4.0 10.0. Notably, the parent LiteSpeed WHM Plugin is not affected - only the end-user cPanel plugin.
Technical ContextAI
The affected component is LiteSpeed Technologies' cPanel integration plugin, which exposes cPanel end-user API endpoints (cpanel_jsonapi) to manage LiteSpeed features including per-account Redis object caching. The root cause is classed as CWE-266 (Incorrect Privilege Assignment): the plugin mishandles its Redis enable/disable feature (the redisAble function) such that an operation intended to run at user privilege can be leveraged to obtain higher privileges, possibly root, on the shared hosting server. The single affected CPE is cpe:2.3:a:litespeed_technologies:cpanel_plugin, and detection relies on grepping cPanel logs (/var/cpanel/logs and /usr/local/cpanel/logs) for the string cpanel_jsonapi_func=redisAble, indicating that exploitation traffic passes through cPanel's authenticated JSON API surface.
RemediationAI
Vendor-released patch: upgrade the LiteSpeed User-End cPanel Plugin to version 2.4.5 or later, as documented in the LiteSpeed security update (https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/) and the LiteSpeed cPanel release log. Because exploitation is confirmed in the wild, treat this as an emergency patch and, before or immediately after upgrading, perform compromise assessment: run grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null - no output means no observed exploitation, while any output should be reviewed for suspicious source IPs, which should be validated and blocked, with system logs for those IPs examined to scope damage. As a compensating control until patched, restrict or disable the plugin's Redis enable/disable feature and limit reachability of the cPanel end-user API to trusted networks; note the trade-off that disabling Redis management removes per-account object-cache control for hosting users. Given the possibility of root-level compromise, rebuild or forensically clean any host showing exploitation evidence rather than relying on the upgrade alone.
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Remote code execution in Redis affects deployments built with TLS support, where a use-after-free in the tlsProcessPendi
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today