Qinglong Task Scheduler Vulnerabilities Exploited for Cryptomining Attacks

In early February 2026, hackers exploited two critical authentication bypass vulnerabilities in the Qinglong task scheduling platform, affecting versions 2.20.1 and earlier. These vulnerabilities, identified as CVE-2026-3965 and CVE-2026-4047, allowed unauthenticated remote code execution, enabling attackers to deploy a cryptominer binary named .fullgc on compromised servers. The attacks were first reported by users experiencing high CPU usage due to the hidden process, which mimicked a legitimate system process to evade detection. The vulnerabilities stemmed from a mismatch between the security middleware's assumptions and the Express.js routing behavior. Despite the initial reports, the Qinglong maintainers only acknowledged the issue on March 1, 2026, urging users to update their systems. However, the initial mitigation was insufficient, and a more effective fix was implemented later. The exploitation has been confirmed across various setups, including those behind Nginx and SSL. The situation highlights the risks associated with publicly exposed application panels.

Key Points: • Two critical vulnerabilities in Qinglong allow unauthenticated remote code execution. • Attackers deployed a cryptominer named .fullgc, causing significant CPU resource drain. • Initial mitigations were ineffective, leading to further exploitation before a proper fix was issued.