Two authentication bypass vulnerabilities in Qinglong task scheduler can be chained to achieve remote code execution. CVE-2026-3965 involves a misconfigured rewrite rule mapping '/open/*' requests to '/api/*', exposing protected admin endpoints. CVE-2026-4047 exploits case-sensitivity mismatch where authentication checks treat paths as case-sensitive while router matches them case-insensitively. Both flaws stem from mismatch between middleware authorization logic and Express.js routing behavior. Attackers exploit these to modify config.sh and inject shell commands that download cryptominers.