Qinglong Task Scheduler RCE Flaws Exploited in the Wild

Hackers are actively exploiting two severe authentication bypass vulnerabilities in Qinglong, a popular open-source task scheduling platform.

These flaws allow attackers to execute arbitrary code and deploy resource-draining cryptomining malware on vulnerable servers.

Qinglong is a self-hosted task management platform used by developers to automate background tasks using Python, JavaScript, Shell, and TypeScript scripts.

With over 19,000 GitHub stars, it is incredibly popular among Chinese developers, who run it in cloud environments and on home servers via Docker containers.

The Authentication Bypass Flaws

The ongoing attacks leverage two distinct security flaws affecting Qinglong versions 2.20.1 and earlier. Both issues arise from a mismatch between the Express.js routing framework and the application’s internal security middleware.

The first flaw, tracked as CVE-2026-3965, is a URL rewriting vulnerability. By sending an unauthenticated, highly specific request to an open endpoint, attackers can force the system to reset the administrator password, thereby gaining full control of the dashboard.

The second flaw, CVE-2026-4047, allows remote code execution (RCE) without requiring any credentials to be reset.

The application’s security layer specifically checks for lowercase URL paths, but the Express.js server processes them case-insensitively. An attacker can request an uppercase path, such as /aPi/, instead of /api/ to bypass security checks and run malicious system commands, as reported by Synk.

Exploitation of these flaws began in early February 2026. System administrators started noticing unusual activity when their servers suddenly maxed out CPU usage to nearly 100%.

Once attackers gained access to the platform, they modified Qinglong’s configuration file to download a malicious binary from an external domain.

This malware was saved as a hidden file named .fullgc. The hackers specifically chose this name to mimic “Full Garbage Collection,” a normal background process in Java environments, in an effort to avoid detection by busy administrators.

The malware heavily targets multiple architectures, including Linux and macOS, and includes a custom persistence script. This ensures that the miner automatically restarts itself if an administrator attempts to kill the process.

While initial community fixes aimed to block specific malicious script inputs, properly securing the platform required patching underlying access-control vulnerabilities. The project maintainers have since released official updates to fix the middleware logic.

Users must immediately update their Qinglong Docker containers to the latest version. Furthermore, administrators should proactively hunt for threats by checking for the hidden .fullgc file or searching the configuration files for unauthorized external domains.

Exposing self-hosted task schedulers directly to the internet is extremely dangerous; teams should always secure these administrative web panels behind a Virtual Private Network (VPN) or secure tunnel.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.