{"id":"CVE-2026-119757","kind":"vulnerability","aliases":["CVE-2026-119757"],"related":[],"title":"BTCPay Server: unauthenticated users can download LND macaroon credential files","description":"BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.","summary":"BTCPay Server before 2.4.2 has an information disclosure flaw that lets an unauthenticated remote attacker retrieve .macaroon credential files for a connected LND Lightning node. An attacker holding such a macaroon can take full control of the node and move its funds.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btcpay-server","lightning","lnd","package","self-hosted"],"not_affected_if":["no-lnd-node","patched-2.4.2-or-later"],"how_to_check":"- Check the installed BTCPay Server version against the fixed version in the product data (`2.4.2`).\n- Confirm whether the deployment connects to an LND node, which is the component the flaw exposes.","fix":"- BTCPay Server: move to `2.4.2` or later.","status":"open","published_at":"2026-11-05T22:17:53+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:32+00:00","updated_at":"2026-11-05T22:46:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T22:46:32Z","model":"claude-haiku-5-5","output":{"fix":"- BTCPay Server: move to `2.4.2` or later.","reach":"internet","title":"BTCPay Server: unauthenticated users can download LND macaroon credential files","impact":"high","summary":"BTCPay Server before 2.4.2 has an information disclosure flaw that lets an unauthenticated remote attacker retrieve .macaroon credential files for a connected LND Lightning node. An attacker holding such a macaroon can take full control of the node and move its funds.","audience":"businesses","category":"package","nicknames":[],"who_cares":["btcpay-server","lnd","lightning","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes full control of the LND node and moves funds.","analyst_note":"Confirm whether the default configuration exposes the macaroon files and read the vulncheck advisory for the exact affected path.","how_to_check":"- Check the installed BTCPay Server version against the fixed version in the product data (`2.4.2`).\n- Confirm whether the deployment connects to an LND node, which is the component the flaw exposes.\n- unknown for any further exposure check, since the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["patched-2.4.2-or-later","no-lnd-node"],"who_is_affected":"Operators running a self-hosted BTCPay Server before 2.4.2, or 2.4.2 release candidates, that is connected to an LND Lightning node. The sources describe the exposure as unauthenticated remote retrieval of macaroon files, so any reachable instance with an LND connection is in scope. Deployments on a different Lightning backend or on a patched version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000742,"input_tokens":4284,"output_tokens":627,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119757':13A,16A '-2026':12A,15A '2.4.2':29B,71C,73C 'affect':121C 'allow':82C 'attack':40B,52B,85C,98C 'btcpay':1A,18B,26B,68C 'btcpay-serv':17B 'candid':75C 'connect':47B 'contain':76C 'control':60B,107C 'credenti':9A,43B,89C 'cve':11A,14A 'daemon':96C 'deploy':122C 'disclosur':33B,79C 'download':6A 'expos':102C 'file':10A,44B,90C 'flaw':34B 'full':59B,106C 'fund':67B,114C,119C 'gain':105C 'hold':53B 'host':25B 'includ':72C,112C 'inform':32B,78C 'let':36B 'lightn':20B,49B,94C 'lnd':7A,21B,48B,93C,110C 'macaroon':8A,42B,56B,88C,103C 'move':65B,113C 'network':95C 'node':50B,63B,97C,111C 'packag':22B 'releas':74C 'remot':39B,84C 'result':115C 'retriev':41B,87C 'self':24B 'self-host':23B 'server':2A,19B,27B,69C 'take':58B 'theft':117C 'unauthent':3A,38B,83C 'use':100C 'user':4A 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Operators running a self-hosted BTCPay Server before 2.4.2, or 2.4.2 release candidates, that is connected to an LND Lightning node. The sources describe the exposure as unauthenticated remote retrieval of macaroon files, so any reachable instance with an LND connection is in scope. Deployments on a different Lightning backend or on a patched version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["btcpayserver","critical","lightning","lnd","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T22:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119757","severity":null,"published_at":"2026-11-05T22:17:53+00:00","modified_at":"2026-11-05T22:17:53+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null}],"documents":[{"id":81012,"url":"https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}