External risk intelligence

BTCPay Server Information Disclosure Allows LND Node Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-119757

BTCPay Server is a payment processing platform designed by necessity to be internet-facing to facilitate transactions. As a public-facing web application and service gateway, it is intended for operation on the public internet, making the underlying services and configuration files directly reachable in normal deployment scenarios.

Information Disclosure

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in BTCPay Server that could allow unauthenticated attackers to gain full control of a Lightning Network node. This exposure of sensitive macaroon credential files may lead to the theft of funds.

Unauthenticated attackers can steal node credentials.
Critical for financial services handling cryptocurrency.
Confirm relevance and verify exposure status.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could potentially access sensitive credential files from a BTCPay Server deployment. This exposure allows them to then control an associated LND node, which could lead to the theft of funds.

No authentication required for access.
Attacker can retrieve macaroon credential files.
Risk of full LND node compromise and fund theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to access sensitive `.macaroon` credential files associated with an LND node when BTCPay Server is deployed. If successful, an attacker could gain complete control over the LND node, potentially leading to the theft of funds.

LND node credentials.
Unauthenticated remote network access.
Theft of cryptocurrency funds.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsibility for addressing this vulnerability likely falls to the platform or infrastructure teams managing the BTCPay Server and its associated LND nodes. Their immediate priority should be to identify all instances of the affected software, confirm its exposure, and determine the business criticality and accountable owner for each deployment before planning remediation efforts.

Platform or infrastructure teams own this issue.
Verify exposure and critical LND node deployments.
Plan coordinated updates or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BTCPay Server?

BTCPay Server is an open-source, self-hosted platform used to process cryptocurrency payments. It acts as a gateway that integrates with various tools, including the Lightning Network Daemon (LND), to facilitate transactions securely without intermediaries. Because it manages financial operations, it often serves as the bridge between a business and the blockchain network, storing necessary configuration and credential data to authorize those payments.

How does CVE-2026-119757 expose sensitive credentials?

This vulnerability involves an information disclosure weakness, specifically categorized under CWE-522 (insufficiently protected credentials) and CWE-552 (files or directories accessible to external parties). It allows an unauthenticated user to retrieve .macaroon files from the server. These files act as authentication tokens for the Lightning Network Daemon; when stolen, they grant the attacker the same administrative permissions as the node owner, effectively bypassing the server's security controls.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not required to exploit this issue. An attacker can initiate the request remotely without needing a user account or any prior access to the system. The vulnerability exists because the software fails to properly restrict access to sensitive files. It is important to note that simply visiting the login page does not trigger the bug; the vulnerability is triggered by specifically targeting the path where these configuration files are stored.

Why is this vulnerability highly relevant for my deployment?

Halo Surface Signal notes that BTCPay Server is designed to be internet-facing to function as a payment processor, making it naturally exposed to the public web. Because your deployment likely sits on the internet to receive transaction data, this vulnerability is easily reachable by remote attackers. If your instance is public-facing, it should be treated as high priority due to the risk of direct node control and potential theft.

What steps should I take if I run BTCPay Server?

First, inventory your systems to identify all instances of BTCPay Server, particularly those managing LND nodes. Verify if your current software version is below 2.4.2, as these are the affected releases. Once identified, consult the official project security advisory to coordinate an update to a patched version. Prioritize these actions to secure your node credentials and prevent unauthorized access to your funds.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.