CVE-2026-119757: BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BTCPay Serverto a version that resolves this vulnerability.Fixed in 2.4.2
Event History
Frequently Asked Questions
Which deployments are exposed?
BTCPay Server versions before 2.4.2 are affected, including 2.4.2 release candidates, when they are used with an LND node whose .macaroon credential files can be retrieved through the vulnerable deployment.
Does exploitation require an account or user interaction?
No. The vulnerability is exploitable remotely by an unauthenticated attacker and requires no user interaction.
What could an attacker do with a disclosed macaroon?
An attacker can use the exposed LND macaroon to gain full control of the LND node, including moving funds. This can result in theft of funds from the affected deployment.
How can I determine whether remediation is needed?
Check the BTCPay Server version in use. Deployments running a version earlier than 2.4.2, including 2.4.2 release candidates, require remediation.