Executive brief
Qinglong is a task scheduling and automation panel used to manage cron jobs and scripts on servers. Due to an incomplete fix for a previous authentication vulnerability, attackers can reset the administrator password on any initialized instance without authentication by exploiting a URL rewrite bypass, granting full administrative control and the ability to execute arbitrary code on the server.
Technical details
The vulnerability is an authentication bypass in Qinglong's initialization endpoint (`/api/user/init`), which is protected by an init guard middleware that only checks for exact path matches of `/api/user/init` and `/api/user/notification/init`. However, the application has a URL rewrite rule (`rewrite('/open/*', '/api/$1')`) that transforms `/open/*` paths to `/api/*` after middleware processing. Additionally, `/open/*` paths are whitelisted from JWT token validation. An attacker can exploit the middleware ordering by sending a request to `/open/user/init`, which bypasses JWT authentication (allowed by whitelist), passes through the init guard (which only checks `/api/*` paths), and is then rewritten to `/api/user/init` where the credential reset handler executes. This allows unauthenticated admin credential reset on any initialized system, leading to full administrative access and arbitrary code execution via cron job scheduling.
Affected products
- whyour qinglong < 2.20.1
Timeline
- 2026-08-20: disclosed: GitHub advisory GHSA-v667-gc2r-2xm7 published
- 2026-06-12: patched: Patch available in version 2.20.1 and commit 6bec52dca158