Privilege Escalation via Phusion Passenger's Watchdog API — CloudLinux package availability

Issue

On 14/08/26 cPanel published a security advisory describing a local privilege escalation vulnerability in Phusion Passenger's Watchdog API, and released patched EasyApache 4 Passenger packages.

The patched versions are not yet available in the CloudLinux repositories. Checking for updates returns nothing to install:

rpm -qa | grep passenger
ea-apache24-mod-passenger-6.1.8-1.el9.cloudlinux.x86_64

yum update ea-apache24-mod-passenger
Nothing to do.
Complete!

Customers running CloudLinux OS with cPanel are asking whether they are affected, what they have to do on their servers, and when the patched packages will reach the CloudLinux repositories.

Environment

• CloudLinux OS (all supported versions: 7, 8, 9) 
• cPanel/WHM 
• EasyApache 4 
• Passenger packages: 
  • ea-apache24-mod-passenger 
  • ea-nginx-passenger 
  • ea-passenger-src 
  • ea-ruby27-mod_passenger 
  • ea-ruby27-rubygem-passenger
  • ea-ruby24-mod_passenger 
  • ea-ruby24-rubygem-passenger

Solution

CloudLinux rebuilds the EasyApache 4 Passenger packages from cPanel sources, so the patched builds carry the .cloudlinux release suffix and become available in the CloudLinux repositories after the rebuild completes. 

Track the current release state on the CloudLinux status page — the incident there is updated as builds are published: https://cloudlinux.statuspage.io/incidents/0mgvl92xffx3

1. Check whether any Passenger package is installed. Servers without these packages are not affected:

   rpm -q ea-apache24-mod-passenger ea-nginx-passenger ea-passenger-src ea-ruby27-mod_passenger ea-ruby27-rubygem-passenger ea-ruby24-mod_passenger ea-ruby24-rubygem-passenger

2. Compare the installed release against the patched CloudLinux release, which is 6.1.8-2.cloudlinux on every supported CloudLinux OS version. An installed release ending in -1 is not patched. Note that this differs from the cPanel advisory on CloudLinux OS 7. cPanel lists 6.0.27-2 for ea-ruby27-mod_passenger and ea-ruby27-rubygem-passenger on el7, but CloudLinux OS 7 already ships Passenger 6.1.8, so the fix is delivered there as 6.1.8-2 as well. On CloudLinux OS 7, 6.1.8-2.cloudlinux is the patched build — a 6.0.27 release is neither expected nor required.
3. Once the CloudLinux build is published, update the packages:

   dnf update ea-apache24-mod-passenger ea-nginx-passenger ea-ruby27-rubygem-passenger ea-ruby27-mod_passenger

On CloudLinux OS 7, use yum in place of dnf.

4. Confirm the new release is installed:

   rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\n' ea-apache24-mod-passenger ea-ruby27-mod_passenger

5. To check for signs of exploitation, search the Apache error logs for the strings API account database is empty and Authentication failed for UID. To capture any future attempts, add PassengerLogLevel 4 through WHM > Apache Configuration > Include Editor > Pre Main Include.

Enabling the cl-ea4-testing repository does not help: the patched builds are not present there either until the rebuild is complete.

The Ruby 2.4 packages (ea-ruby24-mod_passenger, ea-ruby24-rubygem-passenger) are deprecated and are not part of this CloudLinux update. Servers still running them should move to the Ruby 2.7 packages — see Ruby 24 Package Deprecated — Use ea-ruby27-mod_passenger for Ruby > 2.7.

Cause

The vulnerability is in Phusion Passenger itself, not in CloudLinux OS. CloudLinux maintains its own rebuilds of the EasyApache 4 Passenger packages, so a cPanel release does not appear in the CloudLinux repositories at the same moment — the sources have to be rebuilt and tested first. This is why the versions named in the cPanel advisory can be visible on the cPanel side while yum update or dnf update still reports Nothing to do on a CloudLinux server.

Only servers with a Passenger package installed are affected. A default cPanel installation does not include these packages.

Useful Links

• CloudLinux status page — Security: Privilege Escalation via Phusion Passenger's Watchdog API 
• cPanel advisory — Security: Privilege Escalation via Phusion Passenger's Watchdog API 
• Internal task tracking the CloudLinux rebuild: EA4D-979