Which versions of Qinglong are affected by EUVD-2026-44820?

Qinglong task-management platform versions before 2.20.1 contain a critical vulnerability enabling remote attackers to seize administrative control without authentication.. A patch is available.

How to fix or mitigate EUVD-2026-44820?

Within 24 hours: identify all Qinglong instances across your infrastructure and determine which versions are deployed; immediately implement network-layer protections such as WAF rules, IP allowlists, or reverse-proxy authentication for the /open/user/init endpoint to restrict access; isolate internet-facing instances if feasible pending mitigation. Within 7 days: enable detailed logging and alerting for all /open/user/init access and administrator credential modifications; review administrator account activity logs for evidence of prior unauthorized access; brief incident response and infrastructure teams on exploitation indicators. Within 30 days: monitor the Qinglong project repository for version 2.20.1 release; deploy patched version 2.20.1 or later in staging for validation; roll out to production with full testing and rollback procedures documented.

Qinglong EUVD-2026-44820

Q: What is the CVSS score of EUVD-2026-44820?

EUVD-2026-44820 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-55445 CRITICAL

Improper Authentication (CWE-287)

2026-07-15 GitHub_M

GHSA-v667-gc2r-2xm7

Authentication Bypass Qinglong

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Single unauthenticated remote request (AV:N/AC:L/PR:N/UI:N) resets admin credentials granting full read/write control (C:H/I:H); no direct availability destruction primitive, so A:N, consistent with the vendor's VA:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 20, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 22:05 vuln.today

Analysis Generated

Jul 15, 2026 - 22:05 vuln.today

CVE Published

Jul 15, 2026 - 21:20 cve.org

CRITICAL 9.3

DescriptionCVE.org

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

AnalysisAI

Authentication bypass in Qinglong (whyour/qinglong) task-management platform before 2.20.1 lets an unauthenticated remote attacker reset administrator credentials on an already-initialized instance by sending PUT /open/user/init. The flaw stems from a path-rewrite ordering mistake: the init-guard middleware whitelists /open/* through JWT auth, then rewrites it to /api/user/init after the guard's initialization check has already been bypassed. No public exploit identified at time of analysis, but the fixing PR diff publicly discloses the exact bypass, making weaponization trivial; CVSS 4.0 base score is 9.3 (Critical).

Technical ContextAI

Qinglong is a self-hosted cron/timed-task scheduler (Node.js/Express backend, back/loaders/express.ts) that runs user scripts in Python3, JavaScript, Shell, and TypeScript. The affected component is the Express init-guard middleware combined with an internal URL rewrite rule rewrite('/open/*', '/api/$1'). The guard intended to allow the one-time user-initialization endpoint only while an instance is uninitialized by exempting '/api/user/init' (and '/api/user/notification/init') from the 'already-initialized' block. However, the /open/* namespace is whitelisted for JWT-authenticated open-API access and is only rewritten to the /api/* form AFTER both JWT auth and the init guard have run, so the guard never recognizes '/open/user/init' as the initialization path and fails to enforce the initialized-state check on it. This is a classic CWE-287 (Improper Authentication) issue rooted in inconsistent path normalization / middleware ordering - the security decision is made on the pre-rewrite path while the sensitive handler is reached via the post-rewrite path. Per CPE cpe:2.3:a:whyour:qinglong:*, all versions prior to 2.20.1 are affected.

RemediationAI

Vendor-released patch: 2.20.1 - upgrade all Qinglong instances to 2.20.1 or later, which extends the init-guard whitelist check to include '/open/user/init' and '/open/user/notification/init' and evaluates it against req.path so the rewritten open-API paths are also blocked on initialized instances (see PR #2941 and advisory GHSA-v667-gc2r-2xm7). If you cannot immediately upgrade, place the instance behind a reverse proxy or WAF and block or deny external requests to the /open/user/init and /open/user/notification/init paths (and the /api equivalents), since a legitimately initialized instance never needs the init endpoints reachable from untrusted networks; the trade-off is that any tooling relying on the open API through that proxy must be re-tested. As a further compensating control, restrict network exposure of the Qinglong web/API port to trusted management networks or a VPN, accepting the loss of direct internet access to the panel. After patching, rotate the administrator credentials and audit for unexpected account resets or newly added tasks/scripts, since credential takeover enables arbitrary script execution.