CVE-2026-55445

Received Received - Intake

Qinglong Admin Credential Reset via Unauthenticated PUT Request

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-07-16

AI Q&A

2026-07-16

EPSS Evaluated

N/A

NVD

CVE-2026-55445

Affected Vendors & Products

Vendor	Product	Version / Range
qinglong	qinglong	to 2.20.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects Qinglong, a timed task management platform. It allows unauthenticated attackers to reset administrator credentials by sending a specific PUT request to /open/user/init. The issue occurs because the middleware checks /api/user/init but not /open/user/init, and a path rewrite rule allows bypassing authentication for /open/* endpoints.

Impact Analysis

An attacker could gain full administrative control over a Qinglong instance by resetting credentials. This could lead to unauthorized access, data manipulation, or disruption of scheduled tasks. Systems running versions prior to 2.20.1 are vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance may be compromised if sensitive data is exposed or altered due to the flaw.

Detection Guidance

Check if your Qinglong instance is running a version prior to 2.20.1. Inspect network traffic for PUT requests to /open/user/init paths. Verify if administrator credentials can be reset without authentication.

Mitigation Strategies

Upgrade Qinglong to version 2.20.1 or later immediately. Block PUT requests to /open/user/init paths in your firewall or web server configuration. Rotate all administrator credentials if the instance was initialized.

Hi! I’m here to help you understand CVE-2026-55445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70