Article
Mercado Bitcoin and Binance Incidents Compared: Size, Freezes and User Impact
Mercado Bitcoin hack compared with Binance: what was hit, reported amounts, frozen funds and user impact, and how the figure changed across relays.
Read more
Exploited vulnerability
BTCPay Server LND Macaroon Disclosure (CVE-2026-119757)
An information disclosure flaw in BTCPay Server before 2.4.2.
- CVE ID
- CVE-2026-119757
- CVSS
- 9.8 Critical (CVSS v3.1) and 9.3 Critical (CVSS v4.0), both from VulnCheck as CNA; NVD lists the 3.1 score as primary and the 4.0 score as secondary
- Affected product
- BTCPay Server before 2.4.2, including 2.4.2 release candidates; the credential risk applies to LND deployments
- Exploited
- Yes
- Published
- 5 November 2026 (CVE record and NVD); the CVE record lists 6 August 2026 as the public date and the vendor advisory is dated 7 August 2026
In short
CVE-2026-119757 is an information disclosure flaw in BTCPay Server before 2.4.2. It lets an unauthenticated remote attacker retrieve macaroon credential files for an LND node. The maintainers say attackers exploited it and funds were stolen. VulnCheck, the CNA, scores it CVSS 3.1 9.8 and CVSS 4.0 9.3.
- CVECVE-2026-119757
- ProductBTCPay Server (open source project) BTCPay Server before 2.4.2, including 2.4.2 release candidates; the credential risk applies to LND deployments
- ExploitedYesin real attacks
- Fix Steps5actions listedUpdate BTCPay Server and LND · Review LND Node Activity
What it allows
CVE-2026-119757 is an information disclosure flaw in BTCPay Server. Per the CVE record, an unauthenticated remote attacker can retrieve the macaroon credential files for an LND node. LND is the Lightning Network Daemon, an implementation of the Lightning Network.
A macaroon file is a credential for the node. The record says an attacker can use an exposed macaroon to gain full control of the LND node, including moving funds. It describes the result as theft of funds from affected deployments.
What the BTCPay Server Maintainers Say
The maintainers' advisory says attackers exploited the flaw, users were affected and funds were stolen. They say the attacks they reviewed targeted only files with the .macaroon extension. They withheld technical details so that operators had time to update.
The maintainers first advised moving funds out of on-chain wallets, out of caution. After further review they confirmed that only LND is affected. They say BTCPay Server's on-chain wallets, including hot wallets, are not affected, but funds in LND's own on-chain wallet may still be at risk.
We leave out technical details on purpose. Our DMM Bitcoin theft profile covers another crypto theft case.
How the Score Reads
VulnCheck, the CNA, scores it CVSS 3.1 9.8 Critical with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It also gives CVSS 4.0 9.3 Critical with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
NVD lists VulnCheck's 3.1 score as primary and the 4.0 score as secondary. It shows the entry as received on 5 November 2026. See our CVSS entry for how to read the vectors.
What VulnCheck and CISA KEV Say About Exploitation
The CVE record carries VulnCheck's known-exploited-vulnerability tag. VulnCheck's advisory says the CVE is in the VulnCheck KEV database. As of CISA catalog version 2026.11.04, it is not in CISA's Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.
Who is affected
The CVE record lists BTCPay Server before 2.4.2 as affected. The maintainers say this includes the 2.4.2 release candidates and that version 2.4.2 is fixed. The credential risk applies to deployments that use LND.
The maintainers say users of other Lightning implementations, and users who do not use Lightning, are not exposed to the LND credential risk. They still encourage those users to update.
Version 2.4.2 temporarily removes public access to the LND API on Docker deployments. An external wallet such as Zeus cannot connect through the BTCPay Server domain or Tor onion address for now. The maintainers say they plan to restore the option when it is safe.
The maintainers thank Craig Raw for responsible disclosure and Team Red for helping analyze the exploit. The CVE record credits Craig Raw as finder and Team Red as analyst. Our vulnerability management guide covers how to track a fix like this one.
Timeline
- 6 Aug 2026
The CVE record lists this as the public date.
- 7 Aug 2026
The BTCPay Server project posts its advisory, "Update BTCPay Server to 2.4.2 Immediately".
- 2 Nov 2026
The advisory page shows its last update.
- 5 Nov 2026
VulnCheck publishes the CVE record, NVD publishes its entry and VulnCheck publishes its advisory.
What to do
-
Update BTCPay Server and LND
Update to BTCPay Server 2.4.2, which brings LND to 0.21.1. The vendor says to confirm that the admin footer shows 2.4.2 and that the node runs 0.21.1.
-
Take an Unpatched LND Deployment Offline
The vendor says that if you use LND and cannot update right away, you should take the server offline until you can. Do not leave an affected LND deployment reachable from the internet.
-
Review LND Node Activity
Check for payments you did not make, unexpected channel closures and unfamiliar peers. Compare on-chain and channel balances with your own records, and investigate anything you do not recognize.
-
Rotate Credentials on Separate Access Paths
The update regenerates macaroons, but the vendor says it does not close access paths you manage yourself. If you expose LND through your own reverse proxy, Tor service or forwarded port, rotate its credentials now.
-
Plan for the Wallet Connectivity Change
On Docker deployments, external wallets such as Zeus lose their connection through your BTCPay Server domain or onion address after the update. The vendor invites affected users to contact it for another setup.
Questions
Which BTCPay Server versions does CVE-2026-119757 affect?
The CVE record lists versions before 2.4.2. The maintainers say this includes the 2.4.2 release candidates and that 2.4.2 is the fixed version.
Do I need to act if I do not use LND?
The maintainers say users of other Lightning implementations, and users without Lightning, are not exposed to the LND credential risk. They still strongly encourage updating.
Is CVE-2026-119757 being exploited?
The maintainers say attackers exploited it and funds were stolen. VulnCheck lists it in its own KEV database. It is not in CISA KEV as of catalog version 2026.11.04.
Does updating rotate my LND credentials?
The maintainers say the update upgrades LND to 0.21.1 and regenerates its macaroons. Credentials on access paths you manage outside BTCPay Server need separate rotation.
Why can my external wallet not connect after the update?
The maintainers say 2.4.2 temporarily removes public access to the LND API on Docker deployments, to protect nodes. They plan to restore the option when it is safe.
In our research
Sources
- CVE-2026-119757 Record CVE Program / VulnCheck CNA
- CVE-2026-119757 NVD
- Security Advisory: Update BTCPay Server to 2.4.2 Immediately BTCPay Server
- BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure VulnCheck
- Known Exploited Vulnerabilities Catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.