{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abtcpayserverbtcpayserver/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:btcpayserver:btcpayserver:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-119757"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BTCPay Server (\u003c 2.4.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-119757","information-disclosure","cryptocurrency","vulnerability"],"_cs_type":"advisory","_cs_vendors":["BTCPay Server"],"content_html":"\u003cp\u003eBTCPay Server versions prior to 2.4.2, including 2.4.2 release candidates, are susceptible to an information disclosure vulnerability. The flaw permits an unauthenticated remote attacker to retrieve '.macaroon' credential files utilized by the Lightning Network Daemon (LND).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control over the affected LND node. Attackers may perform unauthorized operations, including the movement and theft of funds from the affected Lightning node deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade BTCPay Server to version 2.4.2 or later immediately to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit LND node configurations for unauthorized access or unexpected changes in node management patterns if the instance was exposed to the internet.\u003c/li\u003e\n\u003cli\u003eReview network access controls to ensure the BTCPay Server management interface is not accessible to untrusted network segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T22:32:52Z","date_published":"2026-11-05T22:32:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-btcpay-server-disclosure/","summary":"BTCPay Server versions prior to 2.4.2 are vulnerable to an unauthenticated information disclosure flaw allowing remote attackers to steal LND node macaroon files for full administrative control and fund theft.","title":"BTCPay Server: LND node macaroon information disclosure (CVE-2026-119757)","url":"https://feed.craftedsignal.io/briefs/2026-11-btcpay-server-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:btcpayserver:btcpayserver:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}