# Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining

DevFeed: [Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining](<https://devfeed.tech/articles/qinglong-task-scheduler-rce-vulnerabilities-exploited-in-the-wild-for-cryptomining-8058.md>)

Original publisher: [Read original article](<https://snyk.io/blog/qinglong-task-scheduler-rce-vulnerabilities/>)

Author: Julia Kinday

Published: 2026-04-27T00:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Security](<https://devfeed.tech/topics/security.md>), [Express](<https://devfeed.tech/topics/express.md>), [GitHub Issues](<https://devfeed.tech/topics/github-issues.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Server](<https://devfeed.tech/topics/server.md>), [Shell](<https://devfeed.tech/topics/shell.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [npm](<https://devfeed.tech/topics/npm.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [code](<https://devfeed.tech/tags/code.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [docker](<https://devfeed.tech/tags/docker.md>), [enablement](<https://devfeed.tech/tags/enablement.md>), [github](<https://devfeed.tech/tags/github.md>), [github-issues](<https://devfeed.tech/tags/github-issues.md>), [incident](<https://devfeed.tech/tags/incident.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malware](<https://devfeed.tech/tags/malware.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [routing](<https://devfeed.tech/tags/routing.md>), [security](<https://devfeed.tech/tags/security.md>), [security-labs](<https://devfeed.tech/tags/security-labs.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>), [servers](<https://devfeed.tech/tags/servers.md>), [snyk-code](<https://devfeed.tech/tags/snyk-code.md>), [snyk-container](<https://devfeed.tech/tags/snyk-container.md>), [snyk-learn](<https://devfeed.tech/tags/snyk-learn.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-security-intel](<https://devfeed.tech/tags/snyk-security-intel.md>), [tech](<https://devfeed.tech/tags/tech.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Qinglong, an open-source self-hosted task scheduling panel, was exploited through two authentication bypass vulnerabilities affecting versions 2.20.1 and earlier. Attackers used unauthenticated remote code execution to deploy cryptocurrency miners on publicly accessible installations. The article describes the vulnerabilities, their Express.js routing and middleware flaws, and the impact on operators using cloud VPS instances and home servers.

## Source excerpt

Two authentication bypass vulnerabilities (CVE-2026-3965, CVE-2026-4047) in the Qinglong task scheduling panel were exploited in the wild to deploy cryptomining malware. Here's what happened, how the attacks worked, and what self-hosted application operators should learn from this incident.