cPanel has published a security advisory for a local privilege-escalation issue in Phusion Passenger’s Watchdog API, patched via EasyApache 4 Passenger packages. The company is explicit on scope: this does not affect default cPanel installations. It applies only where one of the listed Passenger packages is installed.
The advisory names no CVE, no reporter, and no attack write-up. Impact is stated in one line: local privilege escalation is possible. Patched package versions are in the table on cPanel’s support article.
Confirmed
- Affected if any of these EA4 packages are present: ea-apache24-mod-passenger, ea-passenger-src, ea-ruby27-rubygem-passenger, ea-ruby27-mod_passenger, ea-ruby24-rubygem-passenger, ea-ruby24-mod_passenger, ea-nginx-passenger — across all cPanel/WHM versions that have them.
- Patched versions in the advisory: most packages 6.1.8-2; Ruby 2.7 on EL7 6.0.27-2; Ruby 2.4 packages 6.0.20-4.
- Vendor update path: /scripts/update-packages, or distro-specific yum/dnf/apt of the already-installed Passenger packages.
- CloudLinux: engineering was still preparing and testing patched packages when the page was published; the advisory says it will be updated when those builds are available.
- If Passenger was installed and reachable before the patch, cPanel suggests grepping Apache error logs for API account database is empty or Authentication failed for UID. A clean grep is not proof of no compromise: those lines are not written at the default log level.
Analysis
On shared hosting the interesting fact is tenancy, not a missing CVE number. A local escalation on a box that already runs other people’s sites is a multi-account problem if the package is actually installed. The log strings point at Watchdog API authentication — not at a public, documented 2018 nginx symlink race. Do not collapse this advisory into CVE-2018-12029; cPanel did not make that link.
The terse advisory is a feature and a cost. Operators get versions and a command. They do not get enough to judge whether unused Ruby apps should be torn out as an interim control. CloudLinux lag means “patched on Alma” is not “patched on CL” until that footnote moves.
Unknown
- Root cause, CVE ID, and whether exploitation has been seen in the wild.
- When CloudLinux packages actually ship.
- How widely the listed EA4 Passenger packages are installed on typical cPanel estates versus default stacks.
Our take
Believe the vendor scope first: Passenger present, then patch; default cPanel is out. Treat the missing CVE as incomplete disclosure, not as proof the issue is mild. Shared-host operators should wait for CloudLinux builds rather than assuming the EL table already covers them.
