Read the docs
TI-2026-85685 Aliases CVE-2026-119757GHSA-87gv-mpgp-xpp2

Information disclosure in BTCPay Server exposes LND macaroon files

Priority MEDIUM 41CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

BTCPay Server before 2.4.2, including 2.4.2 release candidates, exposes .macaroon credential files for LND (Lightning Network Daemon) nodes to outside parties because of insufficiently protected credentials. An unauthenticated remote attacker can retrieve these files. The exposed macaroon gives full control of the LND node, including moving funds, which can lead to theft of funds from affected deployments.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

Why it matters now

EPSS 0.00536 45th percentileScored 2026-11-07
Fix Fixed BTCPay Server (BTCPay Server): 2.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
btcpayserverBTCPay Serverbefore 2.4.22.4.2Patch availableCNA
  • BTCPay Server Vendorbtcpayserver Affected before 2.4.2 Fixed in 2.4.2 Patch available CNA

Remediation

BTCPay Server 2.4.2 fixes this flaw. Upgrade affected BTCPay Server deployments to 2.4.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA BTCPay Server (BTCPay Server) Fixed in 2.4.2

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-119757
  2. 2026-11-06 Alias added: GHSA-87gv-mpgp-xpp2

References

Patch 1

Other 1

  • TI-2023-00467 Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver CVSS 3.1HIGH 8.8
  • TI-2023-00710 Open Redirect in btcpayserver/btcpayserver CVSS 3.1MEDIUM 6.4
  • TI-2023-00834 Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver CVSS 3.1MEDIUM 6.3
  • TI-2023-00768 Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver CVSS 3.1MEDIUM 5.4
  • TI-2023-01087 Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver CVSS 3.1MEDIUM 5.4
  • TI-2023-00709 Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver CVSS 3.1MEDIUM 5.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences