Hackers Exploit Qinglong Authentication Bypasses to Deploy Cryptominers
Summary
Attackers reportedly chained two Qinglong authentication bypasses to run cryptominers on exposed panels. The flaws affect versions 2.20.1 and older; maintainers fixed the bypass in PR #2941.
Key points
- CVE-2026-3965 and CVE-2026-4047 can be chained to achieve remote code execution through authentication bypasses.
- Snyk reports exploitation of publicly exposed Qinglong panels began February 7, before public disclosure.
- Attackers reportedly modified config.sh to download and run miners from file[.]551911[.]xyz, including a binary saved as /ql/data/db/.fullgc.
- The hidden .fullgc process mimicked a Full GC process and reportedly consumed 85% to 100% of CPU.
- The initial mitigation in PR #2924 was insufficient; PR #2941 corrected the authentication bypass.
- Qinglong versions 2.20.1 and older are affected; the article urges users to update.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Affected Versions
- Qinglong 2.20.1 and older
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | file[.]551911[.]xyz | Hosted cryptominer binaries downloaded by attackers. |
MITRE ATT&CK
T1059.004 · Unix ShellAttackers injected shell commands into Qinglong's config.sh to download and execute a cryptominer.T1105 · Ingress Tool TransferThe injected commands downloaded cryptominer binaries from file.551911.xyz.T1190 · Exploit Public-Facing ApplicationAttackers exploited authentication-bypass flaws on publicly exposed Qinglong panels to gain remote code execution.T1496 · Resource HijackingThe deployed cryptominer consumed victim servers' CPU resources for cryptocurrency mining.
CVE
CVE-2026-3965whyour · qinglongThe issues (CVE-2026-3965 and CVE-2026-4047) stem from a mismatch between middleware authorization and Express.js routing and were effectively fixed in PR #2941 after an initial insufficient mitigation;CVE-2026-4047Vendor / Product unavailableThe issues (CVE-2026-3965 and CVE-2026-4047) stem from a mismatch between middleware authorization and Express.js routing and were effectively fixed in PR #2941 after an initial insufficient mitigation;