Unrated

Authentication Bypass via Case-Insensitive /api/ Path Handling in Qinglong

IdentifiersCVE-2026-4047CWE-288

CVE-2026-4047 is an authentication bypass vulnerability in Qinglong affecting version 2.20.1 and earlier. The flaw is caused by a mismatch between Qinglong’s authentication middleware and Express.js routing behavior: the authentication check treats protected paths such as /api/ as case-sensitive, while the router matches paths case-insensitively. As a result, an unauthenticated attacker can send requests to altered path variants such as /aPi/... to bypass authentication and reach endpoints intended to be protected. According to the provided reporting, this issue was documented in GitHub Issue #2934 and was observed to enable direct remote code execution by reaching protected functionality without first resetting credentials.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to bypass access controls on protected Qinglong API endpoints. Based on the provided context, this can lead directly to remote code execution on vulnerable Qinglong instances and was actively exploited in the wild to modify config.sh and deploy a hidden cryptominer (.fullgc), resulting in severe CPU exhaustion and full compromise of exposed panels.

Mitigation

If you can’t patch tonight, do this now.

Until patched, restrict access to Qinglong panels so they are not publicly exposed to the internet, for example by placing them behind a secure VPN or otherwise limiting trusted source access. Monitor for and investigate unauthorized access to protected /api/ functionality via mixed-case path variants such as /aPi/. Audit compromised or potentially exposed systems for persistence or payloads mentioned in the reporting, including hidden .fullgc files/processes and unauthorized modifications to config.sh.

Remediation

Patch, then assume compromise.

Upgrade Qinglong to a version containing the effective fix referenced in the provided context as PR #2941. The initial mitigation that relied on filtering malicious inputs was reported as insufficient because it did not correct the underlying access-control flaw. Remediation should therefore ensure the authentication middleware logic is corrected so that authorization decisions are consistent with actual router path matching behavior. Operators should also update affected Docker containers if Qinglong is deployed via Docker.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

scworldNews

May 1, 2026

Hackers exploit Qinglong vulnerabilities to deploy cryptominers | brief | SC Media

An authentication bypass vulnerability in Qinglong affecting version 2.20.1 and older; it can be chained with CVE-2026-3965 to achieve remote code execution and has been actively exploited to deploy cryptominers.

cyber security newsNews

Apr 30, 2026

Qinglong Task Scheduler RCE Vulnerabilities Exploited in the Wild

An authentication bypass vulnerability in Qinglong caused by case-insensitive URL handling, enabling attackers to bypass protections on /api/ endpoints and achieve direct remote code execution.

bleeping computerNews

Apr 29, 2026

Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining

An authentication bypass vulnerability in Qinglong caused by a mismatch between case-sensitive authentication checks and case-insensitive Express.js routing; it can be chained with another flaw to achieve remote code execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware2

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3