Cpe:2.3:a:btcpayserver:btcpayserver:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3abtcpayserverbtcpayserver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 22:32:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBTCPay Server: LND node macaroon information disclosure (CVE-2026-119757)https://feed.craftedsignal.io/briefs/2026-11-btcpay-server-disclosure/Thu, 05 Nov 2026 22:32:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-btcpay-server-disclosure/BTCPay Server versions prior to 2.4.2 are vulnerable to an unauthenticated information disclosure flaw allowing remote attackers to steal LND node macaroon files for full administrative control and fund theft.BTCPay Server versions prior to 2.4.2, including 2.4.2 release candidates, are susceptible to an information disclosure vulnerability. The flaw permits an unauthenticated remote attacker to retrieve '.macaroon' credential files utilized by the Lightning Network Daemon (LND).

Impact

Successful exploitation results in full administrative control over the affected LND node. Attackers may perform unauthorized operations, including the movement and theft of funds from the affected Lightning node deployments.

Recommendation

  • Upgrade BTCPay Server to version 2.4.2 or later immediately to remediate the vulnerability.
  • Audit LND node configurations for unauthorized access or unexpected changes in node management patterns if the instance was exposed to the internet.
  • Review network access controls to ensure the BTCPay Server management interface is not accessible to untrusted network segments.
]]>criticaladvisorycve-2026-119757information-disclosurecryptocurrencyvulnerability