The Qinglong open-source work scheduling tool has two authentication bypass vulnerabilities that hackers are using to install cryptocurrency on developers’ systems.
According to researchers at cloud-native application security firm Snyk, exploitation began in early February before the security flaws were made public at the end of the month.
Chinese engineers frequently use the self-hosted, open-source time management tool Qinglong. It has more than 19,000 ratings on GitHub and has been forked more than 3,200 times.
The two security flaws can be chained to enable remote code execution and affect Qinglong versions 2.20.1 and earlier:
- CVE-2026-3965: A misconfigured rewriting rule accidentally exposes protected admin endpoints via an unauthenticated path by mapping “/open/” requests to “api/.”
- CVE-2026-4047: The router matches paths case-insensitively, but the authentication check treats them as case-sensitive (/api/). This allows requests like /aPi/… to get past authentication and reach protected endpoints.
A mismatch between Express.js routing behavior and middleware authorization logic is the underlying cause of both vulnerabilities read more about Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.