Paper/Archive/CVE-2026-119757

CVE-2026-119757

BTCPay Server BTCPay Server — BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

Affected

ProductAffectedFixed inSource

BTCPay Server< 2.4.22.4.2CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

patchblog.btcpayserver.org/security-advisory-btcpay-server-2-4-2 writeupbinance.com/en/square/post/384812445203404 writeupvulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure