---
id: "CVE-2026-119757"
page: "https://infrastack.ai/live/CVE-2026-119757"
kind: "vulnerability"
aliases: ["CVE-2026-119757"]
title: "BTCPay Server: unauthenticated users can download LND macaroon credential files"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["btcpay-server", "lightning", "lnd", "package", "self-hosted"]
not_affected_if: ["no-lnd-node", "patched-2.4.2-or-later"]
published_at: "2026-11-05T22:17:53+00:00"
first_seen_at: "2026-11-05T22:46:06+00:00"
updated_at: "2026-11-05T22:46:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119757", "first_seen_at": "2026-11-05T22:46:06+00:00"}]
exploit_sources: []
---

# BTCPay Server: unauthenticated users can download LND macaroon credential files

Link for people: https://infrastack.ai/live/CVE-2026-119757 (this .md is for agents)

BTCPay Server before 2.4.2 has an information disclosure flaw that lets an unauthenticated remote attacker retrieve .macaroon credential files for a connected LND Lightning node. An attacker holding such a macaroon can take full control of the node and move its funds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BTCPay Server version against the fixed version in the product data (`2.4.2`).
- Confirm whether the deployment connects to an LND node, which is the component the flaw exposes.

## Fix

- BTCPay Server: move to `2.4.2` or later.

## Timeline

- 2026-11-05T22:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119757

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure

## From the sources

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_