CVE-2026-55445: Qinglong Improper Authentication Vulnerability Allows Unauthenticated Admin Credential Reset
Summary
CVE-2026-55445: Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication. Affects @whyour/qinglong versions < 2.20.1. Fixed in 2.20.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qinglong is an open-source task scheduling and management tool built on Node.js, designed to facilitate the automation of various tasks through cron jobs. It provides a web interface for users to manage these tasks efficiently. However, it has been found to have a critical vulnerability related to improper authentication, which can lead to unauthorized access and administrative control.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous issue (CVE-2026-3965). The init guard middleware in Qinglong only checks specific API paths for authentication, allowing the '/open/user/init' path to bypass this check due to its whitelisted status. This flaw enables an unauthenticated attacker to reset admin credentials by sending a PUT request to '/open/user/init', thereby gaining full administrative access to the Qinglong panel. The technical details reveal that the URL rewrite occurs after the guard has already passed, creating a significant security risk.
How To Fix
Latest published version: 2.23.0 as of 23 Oct 2026
npm install @whyour/qinglong@2.23.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.20.1
This is the first release that contains the fix.
npm install @whyour/qinglong@2.20.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the init guard middleware to include '/open/user/init' and '/open/user/notification/init' in the check list. Alternatively, consider moving the URL rewrite middleware to run before the init guard to prevent unauthorized access.
Conclusion
The Qinglong package has a critical vulnerability (CVE-2026-55445) that allows unauthenticated access to reset admin credentials. It is crucial to update to the patched version to secure your application and prevent unauthorized access. Implementing the suggested workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for @whyour/qinglong →
FAQ
CVE-2026-55445 is a vulnerability in the Qinglong package that allows unauthenticated users to reset admin credentials due to improper authentication checks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
An attacker exploiting this vulnerability can gain full administrative access to the Qinglong panel, allowing them to execute arbitrary cron jobs and scripts on the server.
Yes, a patched version of the Qinglong package is available. You should update to version >= 6bec52dca158 to mitigate this vulnerability.
The CVSS score of this vulnerability is 9.3, indicating a critical level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @whyour/qinglong.
