Information Disclosure Vulnerability in BTCPay Server by BTCPay
CVE-2026-119757

9.3CRITICAL

Key Information:

Vendor

Btcpay Server

Status
Btcpay Server
Vendor
CVE Published:
5 November 2026

What is CVE-2026-119757?

BTCPay Server versions prior to 2.4.2, including release candidates, are vulnerable to an information disclosure flaw. This vulnerability enables unauthenticated remote attackers to access sensitive .macaroon credential files associated with the Lightning Network Daemon (LND). Such exposure permits attackers to exert full control over the LND node, potentially allowing them to manipulate funds, thereby posing a significant risk of financial loss for systems affected by this flaw.

Affected Version(s)

BTCPay Server 0 < 2.4.2

References

https://blog.btcpayserver.org/security-advisory-btcpay-se...
vendor-advisorypatch
https://www.binance.com/en/square/post/384812445203404
technical-description
https://www.vulncheck.com/advisories/btcpay-server-lnd-ma...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Craig Raw
Team Red
.