Security advisory · VP-2026-006
Some removed database hosts and subdomains stayed active
A remote database host removed from an account kept its database access, and a deleted subdomain kept serving its HTTPS site. Vanta Panel 5.52 removes both completely.
- Severity
- Medium
- Affected
- Vanta Panel 5.51 and earlier
- Fixed in
- Vanta Panel 5.52
- Component
- vPanel removals
- Published
Who is affected?
Accounts where a remote database host or a subdomain was removed before 5.52.
Affected: Vanta Panel 5.51 and earlier. Fixed in Vanta Panel 5.52.
What should I do?
Update to Vanta Panel 5.52 or later. Removals made on an older version are not cleaned up by the update: check that remote database hosts removed earlier no longer have a MySQL user, and that deleted subdomains no longer answer over HTTPS.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
No. The fix applies to removals made after the update.
Credit
Found in Vanta Panel's own testing.
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-006
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-006?
Vanta Panel 5.51 and earlier that have not installed the fix. It is fixed in Vanta Panel 5.52.
What should I do about VP-2026-006?
Update to Vanta Panel 5.52 or later. Removals made on an older version are not cleaned up by the update: check that remote database hosts removed earlier no longer have a MySQL user, and that deleted subdomains no longer answer over HTTPS.
Is the fix for VP-2026-006 installed automatically?
No. The fix applies to removals made after the update.
Other advisories
VP-2026-007Criticalfixed in 5.54
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
VP-2026-005Highfixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
VP-2026-004Highfixed in 5.50
Database permissions could reach another account's databases
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash