THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/Hackers Exploit RCE Flaws in Qinglong Scheduler for Cryptomining

VERIFIEDBy Xavier Rivera· ·1 min read

Hackers Exploit RCE Flaws in Qinglong Scheduler for Cryptomining

Hackers chain two authentication bypass flaws in Qinglong versions 2.20.1 and older for RCE and cryptomining since early February. Snyk reports ongoing attacks on exposed panels, with a proper fix only in recent PR #2941.

Source:BleepingComputer

Post

Hackers Exploit RCE Flaws in Qinglong Scheduler for Cryptomining

TL;DRAI · 60 sec read

Hackers exploit two authentication bypass vulnerabilities in the Qinglong open-source task scheduling tool to deploy cryptominers on developers' servers.

Exploitation began in early February 2026, before Snyk researchers publicly disclosed the issues at month's end. Qinglong, a self-hosted time management platform popular among Chinese developers, boasts over 3,200 forks and 19,000 GitHub stars. The flaws affect versions 2.20.1 and older, chainable for remote code execution.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

CVE-2026-3965 stems from a misconfigured rewrite rule mapping '/open/*' requests to '/api/*', exposing admin endpoints. CVE-2026-4047 arises because authentication checks treat paths as case-sensitive while Express.js routing is case-insensitive, allowing bypasses like '/aPi/...'. Snyk attributes both to a mismatch between middleware authorization and framework behavior.

Attackers targeted public Qinglong panels starting February 7, injecting shell commands via modified config.sh to download miners from file.551911.xyz. These include Linux x86_64, ARM64, and macOS variants, executed as a hidden '.fullgc' process consuming 85% to 100% CPU—mimicking 'Full GC' to evade detection. Infections hit setups behind Nginx and SSL.

Qinglong maintainers acknowledged the issues on March 1, releasing PR #2924 to block command injection—deemed insufficient by Snyk. The effective fix arrived in PR #2941, correcting the authentication bypass.

EXPERT TAKE

Expert Take: Self-hosted Qinglong admins must upgrade to PR #2941 and restrict public exposure to block these auth bypass chains.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

security vulnerability cryptomining

MORE IN TECH

Tesla and SpaceX confirm Terafab chip fab in Texas

Tesla and SpaceX have confirmed Grimes County, Texas as the site for their Terafab semiconductor megafactory, with the first phase costing roughly $16.8 billion. The project targets the largest chip manufacturing facility on the planet to supply over 1 terawatt of compute per year that exceeds current and future global production capacity.

OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

OpenAI has filed a motion asking a federal judge to dismiss Apple's trade secrets lawsuit, describing the claims as meritless. The dispute, which follows a July suit and this week's injunction request from Apple, highlights tensions after their prior partnership on Siri and OpenAI's hardware push.

Meta introduces Muse Code, its terminal-based coding agent

Meta has released an early beta of Muse Code, a terminal-based coding agent driven by the updated Muse Spark 1.2 model and positioned against Anthropic's Claude Code and OpenAI's Codex. Substantially lower rates, including a contributor plan at $0.10 for every million tokens received, may encourage migration away from higher-priced options such as Anthropic's Sonnet 5.