CVE-2026-119757

CVSS 9.8 (critical) · published 2026-11-05

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

Weakness: CWE-522, CWE-552

Source: NVD CVE-2026-119757

References

• https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/
• https://www.binance.com/en/square/post/384812445203404
• https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.