CVE-2026-119757 · Package
NO FIX YET · SEE WHAT TO DO
BTCPay Server before 2.4.2 has an information disclosure flaw that lets an unauthenticated remote attacker retrieve .macaroon credential files for a connected LND Lightning node. An attacker holding such a macaroon can take full control of the node and move its funds.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Operators running a self-hosted BTCPay Server before 2.4.2, or 2.4.2 release candidates, that is connected to an LND Lightning node. The sources describe the exposure as unauthenticated remote retrieval of macaroon files, so any reachable instance with an LND connection is in scope. Deployments on a different Lightning backend or on a patched version can skip it.
Not affected if no-lnd-node, patched-2.4.2-or-later
Who cares btcpay-server, lightning, lnd, self-hosted
2.4.2).2.4.2 or later.BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.