What is CVE-2026-4047?
Improper Handling of Case Sensitivity (authentication bypass) in @whyour/qinglong (Qinglong), an open-source scheduled task management platform. The custom authentication middleware matches the API path case-sensitively against the lowercase prefix "/api/", while the underlying Express.js router matches routes case-insensitively. A remote, unauthenticated attacker can bypass the auth/JWT check by sending a request with an altered-case path such as "/aPi/system/command-run" instead of "/api/system/command-run"; the request skips the middleware auth check but still resolves to the intended route handler, granting administrative access and enabling arbitrary system command execution. Affected: @whyour/qinglong versions before 2.20.2-0. Fixed in 2.20.2-0.
The record classifies CVE-2026-4047 under weakness class CWE-178.
Severity and exploitation probability
- CVSS v4.0 base score
- 9.3 — Critical (derived from score)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L - CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
Is CVE-2026-4047 being exploited?
No public exploitation evidence for CVE-2026-4047 is recorded in the sources Threadlinqs tracks — CISA KEV, Exploit-DB, public proof-of-concept repositories and ProjectDiscovery Nuclei — as of 2026-10-05. That is an absence of evidence in those feeds, not a guarantee that the vulnerability is unexploited.
Affected products and versions
No affected-product or package list has been recorded for CVE-2026-4047 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.
How to fix CVE-2026-4047
No vendor patch reference has been recorded for CVE-2026-4047 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-4047
1 tracked threat in the Threadlinqs corpus references CVE-2026-4047, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Seeded from research_verified and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.