Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API

Vitalii Zhidkov

Updated July 27, 2026 12:39

kb: technical

Situation

A security vulnerability CVE-2026-58046 allowing a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database was discovered in Plesk's XML-RPC API.

Affected product version

Product / Component	Affected versions	Patched version
Plesk	All versions below 18.0.79.4	18.0.79.4

Impact

An authenticated user with customer or reseller privileges can execute arbitrary SQL queries against the Plesk database. This may allow reading the entire database contents, including administrator credentials, potentially leading to full server compromise.

Call to action

Log into Plesk.
Go to Tools & Settings > Updates and Upgrades.
Install the latest Plesk updates to update to version 18.0.79.4 or later.
Verify the installed version under Tools & Settings > Server Components.

Mitigation

Apply this mitigation only if you cannot upgrade right now.

Plesk Obsidian 18.x

Connect to the server via SSH.
Edit the panel.ini file and add the following section to enforce strict API protocol version validation:

CONFIG_TEXT: [api]
deprecationError = on

This setting blocks deprecated XML API protocol versions that allow bypassing input validation, preventing exploitation of this vulnerability.
Upgrade to Plesk 18.0.79.4 or later as soon as possible.

Plesk Onyx 17.x and lower

Connect to the server via SSH.
Edit the panel.ini file and add the following section to restrict XML API access to trusted IP addresses only:

Note: Replace 203.0.113.2 and 192.0.2.2 with the actual IP addresses that should retain API access.

CONFIG_TEXT: [api]
allowedIPs = 203.0.113.2,192.0.2.2

For more details, see How to disable or restrict Plesk XML API.

Warning: Disabling or restricting the XML API will also affect REST API access.
Upgrade to Plesk 18.0.79.4 or later as soon as possible.