Important Plesk Security Update: CVE-2026-58046

Plesk has released an important security update addressing CVE-2026-58046, an authenticated SQL injection vulnerability affecting the Plesk XML-RPC API. All Plesk servers should be updated to version 18.0.79.4 or later.

Overview

A security vulnerability identified as CVE-2026-58046 has been discovered in the Plesk XML-RPC API.

The vulnerability allows an authenticated user with low-level customer or reseller privileges to perform a blind SQL injection attack against the Plesk database.

Successful exploitation could allow an attacker to access sensitive database information, including administrator credentials, potentially resulting in full server compromise.

Affected Plesk Versions

All Plesk versions below 18.0.79.4 are affected.

The vulnerability has been addressed in:

Plesk Obsidian 18.0.79 Update 4 or later

How to Update Plesk

1. Update from Tools & Settings > Updates and Upgrades, then confirm under Tools & Settings > Server Components that the version is 18.0.79.4 or later.

The installed Plesk version must be 18.0.79.4 or later.

Temporary Mitigation

The following mitigation should only be used when an immediate update is not possible.

Plesk Obsidian 18.x

Connect to the server through SSH and add the following configuration to the Plesk panel.ini file:

[api]
deprecationError = on

On Linux servers, the file is normally located at:

/usr/local/psa/admin/conf/panel.ini

This setting enforces strict API protocol version validation and blocks deprecated XML API protocol versions that can bypass input validation.

Plesk Onyx 17.x and Earlier

Restrict XML API access to trusted IP addresses by adding the following configuration:

[api]
allowedIPs = 203.0.113.2,192.0.2.2

Replace the example addresses with the trusted IP addresses that require API access.

Please note that restricting the Plesk XML API may also affect REST API access.

EuroVPS Recommendation

Customers who require assistance checking their Plesk version, installing the update, or applying the temporary mitigation may contact the EuroVPS support team.