BTCPay Server: LND node macaroon information disclosure (CVE-2026-119757)
BTCPay Server versions prior to 2.4.2 are vulnerable to an unauthenticated information disclosure flaw allowing remote attackers to steal LND node macaroon files for full administrative control and fund theft.
CVE search metadata
CVE search record: CVE-2026-119757. Severity: critical. CVSS: 9.8. KEV: no. Product: BTCPay Server (< 2.4.2). Brief: BTCPay Server: LND node macaroon information disclosure (CVE-2026-119757). Brief link: https://feed.craftedsignal.io/briefs/2026-11-btcpay-server-disclosure/
Triage facts
Revision 1- Applicability
- BTCPay Server (< 2.4.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 22:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
BTCPay Server versions prior to 2.4.2, including 2.4.2 release candidates, are susceptible to an information disclosure vulnerability. The flaw permits an unauthenticated remote attacker to retrieve '.macaroon' credential files utilized by the Lightning Network Daemon (LND).
Impact
Successful exploitation results in full administrative control over the affected LND node. Attackers may perform unauthorized operations, including the movement and theft of funds from the affected Lightning node deployments.
Recommendation
- Upgrade BTCPay Server to version 2.4.2 or later immediately to remediate the vulnerability.
- Audit LND node configurations for unauthorized access or unexpected changes in node management patterns if the instance was exposed to the internet.
- Review network access controls to ensure the BTCPay Server management interface is not accessible to untrusted network segments.
Immediate actions
Upgrade BTCPay Server to version 2.4.2 or later.
Threat Hunt
Identify unauthorized access to internal BTCPay Server paths related to LND configuration or macaroon files.
Data: Web server access logs
Mitigations
Upgrade BTCPay Server to version 2.4.2 or later.
CVE-2026-119757