Security advisory · VP-2026-003
The panel's unprivileged service account could gain root access
On versions up to 5.48, someone who already controlled the panel's own unprivileged service account could gain full control of the server. Vanta Panel 5.49 removes the cause and repairs existing installations on its first run.
- Severity
- High
- Affected
- Vanta Panel 5.48 and earlier
- Fixed in
- Vanta Panel 5.49
- Component
- Installed panel files and updater
- Published
Who is affected?
Every server on 5.48 or earlier. It needs prior control of the panel's service account, so it matters most in combination with another weakness.
Affected: Vanta Panel 5.48 and earlier. Fixed in Vanta Panel 5.49.
What should I do?
Update to Vanta Panel 5.49 or later. Nothing else is needed: the update repairs the installation once, and every later update checks it again.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
Yes. 5.49 repairs existing installations automatically on its first run.
Credit
Found in Vanta Panel's own security review.
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-003
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-003?
Vanta Panel 5.48 and earlier that have not installed the fix. It is fixed in Vanta Panel 5.49.
What should I do about VP-2026-003?
Update to Vanta Panel 5.49 or later. Nothing else is needed: the update repairs the installation once, and every later update checks it again.
Is the fix for VP-2026-003 installed automatically?
Yes. 5.49 repairs existing installations automatically on its first run.
Other advisories
VP-2026-007Criticalfixed in 5.54
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
VP-2026-006Mediumfixed in 5.52
Some removed database hosts and subdomains stayed active
VP-2026-005Highfixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash