Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-119757: BTCPay Server leaks LND credential files
CVE-2026-119757 · published 3 days ago
Summary
BTCPay Server versions before 2.4.2 can expose the credential files used by a Lightning Network node. An attacker who obtains these files can control the node and move its funds. Upgrade BTCPay Server to version 2.4.2 or later and review any exposed credentials.
What to do
- Update btcpay server btcpay server to version 2.4.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| btcpay server | btcpay server | < 2.4.2 |
Original advisory text
BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
References
- https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/ Patch
- https://www.binance.com/en/square/post/384812445203404 Third Party Advisory
- https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1197... Vendor Advisory
- https://github.com/btcpayserver/btcpayserver Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-119757 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-552Files or Directories Accessible to External Parties
CWE-522Insufficiently Protected Credentials
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Track software like this
Free during beta