Description
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
Published: 2026-11-05
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows an unauthenticated remote attacker to read .macaroon credential files used by the Lightning Network Daemon (LND) in BTCPay Server versions prior to 2.4.2. The disclosed files contain login credentials that provide full access to the LND node, enabling the attacker to move funds and effectively steal Bitcoin from the victim's wallets.

Affected Systems

BTCPay Server deployments running any version earlier than 2.4.2, including all 2.4.2 release candidates, are potentially affected. The vulnerability is specific to the BTCPay Server product and targets its integration with LND for Lightning Network functionality.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating a critical level of risk. Although no EPSS score is available, there is no indication that the issue is listed in CISA's KEV catalog. Attackers can exploit the flaw by connecting to the BTCPay Server instance over the network and retrieving the credential files without authentication; the exposed macaroon can then be used to issue arbitrary commands to the LND node, effectively providing attacker control over all funds managed by that node.

Generated by OpenCVE AI on November 5, 2026 at 23:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade BTCPay Server to version 2.4.2 or later.
  • Restrict access to the LND macaroon directory by enforcing file‑system permissions or network firewall rules.
  • If an upgrade cannot be performed immediately, monitor log files for unauthenticated access attempts and rotate the LND macaroon credentials.

Generated by OpenCVE AI on November 5, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
Description BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
Title BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
Weaknesses CWE-522
CWE-552
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-05T21:44:41.727Z

Reserved: 2026-10-30T15:31:52.080Z

Link: CVE-2026-119757

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T22:17:53.203

Modified: 2026-11-05T22:17:53.203

Link: CVE-2026-119757

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T23:30:16Z

Weaknesses
  • CWE-522

    Insufficiently Protected Credentials

  • CWE-552

    Files or Directories Accessible to External Parties