{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qinglong/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-3965"},{"id":"CVE-2026-55445"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["qinglong"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["whyour"],"content_html":"\u003cp\u003eThe Qinglong panel contains an authentication bypass vulnerability, tracked as CVE-2026-3965 and CVE-2026-55445, stemming from an incomplete implementation of its initialization security guard. The application uses an 'init guard' middleware to prevent unauthorized access to the \u003ccode\u003e/api/user/init\u003c/code\u003e and \u003ccode\u003e/api/user/notification/init\u003c/code\u003e endpoints once the panel is configured. However, a URL rewrite configuration transforms incoming \u003ccode\u003e/open/*\u003c/code\u003e requests into \u003ccode\u003e/api/*\u003c/code\u003e paths after the guard middleware has already evaluated the request. Because the guard middleware does not account for the \u003ccode\u003e/open/user/init\u003c/code\u003e path, which is explicitly whitelisted from JWT authentication, an unauthenticated attacker can submit a crafted request to reset the panel's administrative credentials. This flaw enables full administrative control over the Qinglong instance, allowing the execution of arbitrary cron jobs and system scripts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target Qinglong panel instance exposed to the internet.\u003c/li\u003e\n\u003cli\u003eAttacker probes for the \u003ccode\u003e/open/user/init\u003c/code\u003e endpoint to check for reachability.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a PUT request directed at \u003ccode\u003e/open/user/init\u003c/code\u003e containing new desired administrative credentials.\u003c/li\u003e\n\u003cli\u003eThe Qinglong application's JWT middleware encounters the request, identifies the \u003ccode\u003e/open/\u003c/code\u003e prefix, and skips authentication as per its whitelist.\u003c/li\u003e\n\u003cli\u003eThe init guard middleware processes the request path, fails to find \u003ccode\u003e/open/user/init\u003c/code\u003e in its blocklist, and allows the request to proceed.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eexpress-urlrewrite\u003c/code\u003e middleware executes, transforming the request URI from \u003ccode\u003e/open/user/init\u003c/code\u003e to \u003ccode\u003e/api/user/init\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application processes the request as a legitimate initialization call, overwriting existing admin credentials.\u003c/li\u003e\n\u003cli\u003eAttacker logs in with the new credentials to gain full administrative access and schedule malicious tasks.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker full administrative access to the Qinglong panel. In many enterprise environments, Qinglong is used to manage cron jobs, scripts, and system automation tasks, meaning this bypass results in the ability to execute arbitrary commands at the privilege level of the application process, potentially leading to full server compromise, data exfiltration, or lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate Qinglong to version \u0026gt;= 6bec52dca158 or the latest stable release to incorporate the fix for CVE-2026-3965 and CVE-2026-55445.\u003c/li\u003e\n\u003cli\u003eDeploy the webserver-based detection rule provided below to identify attempts to access the initialization endpoints via the bypass path.\u003c/li\u003e\n\u003cli\u003eImplement network-level restrictions or VPN access for Qinglong panel interfaces to prevent unauthenticated access from the public internet.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-20T19:12:15Z","date_published":"2026-08-20T19:12:15Z","id":"https://feed.craftedsignal.io/briefs/2026-08-qinglong-auth-bypass/","summary":"An improper authentication vulnerability in Qinglong panel allows unauthenticated remote attackers to reset administrative credentials by leveraging an inconsistent init guard middleware and URL rewrite behavior.","title":"Authentication Bypass in Qinglong Panel via URL Rewrite","url":"https://feed.craftedsignal.io/briefs/2026-08-qinglong-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Qinglong","version":"https://jsonfeed.org/version/1.1"}