# CVE-2026-4047

> As of 2026-10-05, CVE-2026-4047 is a Critical-severity (band derived from the CVSS v4.0 score, not stated by the CNA) vulnerability, CVSS v4.0 9.3. Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-4047, most recently “Qinglong Task Scheduler Auth Bypass Chain to RCE (CVE-2026-3965, CVE-2026-4047) — .fullgc Cryptomining Campaign”.

**Last updated:** 2026-10-05

## What is CVE-2026-4047?

Improper Handling of Case Sensitivity (authentication bypass) in @whyour/qinglong (Qinglong), an open-source scheduled task management platform. The custom authentication middleware matches the API path case-sensitively against the lowercase prefix "/api/", while the underlying Express.js router matches routes case-insensitively. A remote, unauthenticated attacker can bypass the auth/JWT check by sending a request with an altered-case path such as "/aPi/system/command-run" instead of "/api/system/command-run"; the request skips the middleware auth check but still resolves to the intended route handler, granting administrative access and enabling arbitrary system command execution. Affected: @whyour/qinglong versions before 2.20.2-0. Fixed in 2.20.2-0.

The record classifies CVE-2026-4047 under weakness class [CWE-178](https://cwe.mitre.org/data/definitions/178.html).

## Severity and exploitation probability

- **CVSS v4.0 base score:** 9.3 — Critical (derived from score) (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L`)
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog

## Is CVE-2026-4047 being exploited?

No public exploitation evidence for CVE-2026-4047 is recorded in the sources Threadlinqs tracks — CISA KEV, Exploit-DB, public proof-of-concept repositories and ProjectDiscovery Nuclei — as of 2026-10-05. That is an absence of evidence in those feeds, not a guarantee that the vulnerability is unexploited.

## Affected products and versions

No affected-product or package list has been recorded for CVE-2026-4047 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2026-4047

No vendor patch reference has been recorded for CVE-2026-4047 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-4047

1 tracked threat in the Threadlinqs corpus references CVE-2026-4047, either in the campaign’s CVE list or as an indicator on the campaign record.

- [Qinglong Task Scheduler Auth Bypass Chain to RCE (CVE-2026-3965, CVE-2026-4047) — .fullgc Cryptomining Campaign](https://intel.threadlinqs.com/threat/TL-2026-0441) — CRITICAL · 2026-05-01

## Sources

Seeded from `research_verified` and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

- [security.snyk.io](https://security.snyk.io/vuln/SNYK-JS-WHYOURQINGLONG-15468374)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-4047
Full detection coverage and IOCs for threats exploiting CVE-2026-4047 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp