CVE-2026-55445: Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

August 20, 2026

The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.

References

github.com/advisories/GHSA-v667-gc2r-2xm7
github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719
github.com/whyour/qinglong/pull/2941
github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7
nvd.nist.gov/vuln/detail/CVE-2026-55445

Code Behaviors & Features

Detect and mitigate CVE-2026-55445 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →