CVE-2026-119757
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, i…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.4.2 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
Last activity 5 Nov 2026. Patch Forecast updates every hour.