A Crack in the Wall Between Tenants
A critical vulnerability in LiteSpeed Web Server (LSWS) Enterprise could let a single low-privilege website user on a shared hosting server break out of tenant isolation and gain root access to the entire machine — including every other customer's site hosted on it. cPanel disclosed the flaw in an advisory published September 14, 2026.
On shared-hosting infrastructure, dozens or hundreds of unrelated customer sites commonly run on a single server, separated only by isolation mechanisms like CageFS. A flaw that lets one tenant bypass those controls threatens every other tenant on the box simultaneously.
Vulnerability Summary
| Field | Value |
|---|---|
| CVE ID | Not yet assigned (as of September 15, 2026) |
| Severity | Critical (privilege escalation to root) |
| Affected Versions | LiteSpeed Web Server Enterprise before 6.3.7 |
| Root Cause | Undisclosed by cPanel or LiteSpeed |
| Disclosed By | cPanel |
| Patched Version | LiteSpeed 6.3.7 (released September 11, 2026) |
| Active Exploitation | None confirmed at time of writing |
According to cPanel's advisory, the flaw lets an attacker "bypass the controls that keep hosting accounts apart, including CageFS," ultimately compromising other sites and the server's own configuration. Neither cPanel nor LiteSpeed has published a technical explanation of the underlying mechanism, and the advisory covers the Enterprise edition only — the status of the free OpenLiteSpeed variant is unclear.
Why This Matters
Shared hosting providers depend entirely on tenant isolation to safely co-locate unrelated customers on the same hardware. A root-level CageFS bypass means a single malicious or compromised hosting account — even one with no special privileges — could pivot into every neighboring account, tamper with server-wide configuration, or plant persistence that survives account-level cleanup. For hosting providers, this is as close to a worst-case scenario as a web server flaw gets.
Mitigation
Immediate Actions
- Update immediately by running:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 - Do not rely on auto-update alone — cPanel's advisory notes that automatic updates may be delayed, and manual installation is recommended for servers that need to close the gap quickly.
- No workarounds are available for servers that cannot update immediately; patching is the only remediation path.
- No indicators of compromise have been published, so retroactively confirming prior exploitation is not currently possible — treat unpatched systems as at-risk going forward rather than attempting to audit past activity.
Hosting providers and resellers running LiteSpeed Enterprise on multi-tenant infrastructure should prioritize this update ahead of routine patch cycles given the severity of a full tenant-isolation bypass.