CVE-2026-119757

What it is. BTCPay's advisory says attackers could retrieve the LND node's .macaroon files without logging in. A macaroon is the credential LND uses to authorize API calls, and the CVE record says an exposed one gives full control of the node, including moving funds. BTCPay has not published the request path. It says the attacks it reviewed targeted files with the .macaroon extension.

Who is affected. Per BTCPay, the credential risk applies only to deployments that use LND. Servers on another Lightning implementation, or with no Lightning at all, are not exposed to this flaw, though BTCPay still urges them to update. On-chain wallets, hot wallets included, are not affected. Funds in LND's own on-chain wallet may still be at risk.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on servers your organization owns.

1. Is the server below 2.4.2? This decides exposure, together with the next check. BTCPay says the version appears in the footer of the admin pages. 2.4.2 or later is fixed.
2. Does it run LND? Only LND deployments are exposed. On a Docker deployment, this lists running containers with LND in the name.
   docker ps --format '{{.Names}}' | grep -i lnd
   The store's Lightning settings in BTCPay also show which node a store uses.
3. Can LND be reached by another route? BTCPay says updating does not close routes you set up yourself, such as your own reverse proxy, a Tor service or a forwarded port to LND. If any exist, rotate LND's credentials as well as updating.

Public code. No public exploit code has been published as far as we found. BTCPay has not described the request the attackers used.

BTCPay's only workaround is to take the server offline if it runs LND and cannot be updated right away. Its advisory says not to leave an affected LND deployment reachable from the internet.

• Update. Move to BTCPay Server 2.4.2 or later, then confirm the admin footer shows 2.4.2 and the LND node runs 0.21.1. The update regenerates macaroons automatically, and BTCPay says they can also be rotated by hand.
• Close other routes. If LND is exposed through your own reverse proxy, Tor service or forwarded port, rotate its credentials. BTCPay says updating BTCPay Server does not close those routes.
• Check the node. BTCPay recommends reviewing the LND node after updating, as described under what to look for in logs.

BTCPay has not published network indicators beyond the file type the attacks targeted. These come from its advisory.

• Web requests for files ending in .macaroon. BTCPay says the attacks it reviewed targeted them. This searches web server access logs on a typical Linux host.
  grep -i '\.macaroon' /var/log/nginx/access.log*
• Lightning payments you did not make.
• Channel closures you did not start.
• Unfamiliar peers on the node.
• Balances that do not match your records.

Is CVE-2026-119757 being exploited?

Yes, according to BTCPay. Its advisory says attackers exploited it, users were affected and funds were stolen, and the 2.4.2 release notes say it was being actively exploited when the fix shipped. It is not on CISA KEV as of the November 6, 2026 catalog. VulnCheck lists it in its own exploited catalog.

Which BTCPay Server versions are affected?

All versions before 2.4.2, including the 2.4.2 release candidates. Only servers that run LND are exposed.

If we updated to 2.4.2 in August, are we covered?

For BTCPay itself, yes. The update also upgrades LND to 0.21.1 and regenerates macaroons. If LND is also reachable through your own proxy, Tor service or forwarded port, rotate its credentials too, since the update does not close those routes.

Are on-chain wallets affected?

BTCPay says on-chain wallets, hot wallets included, are not affected. Funds in LND's own on-chain wallet may still be at risk.

What should we do if we cannot update today?

Take the server offline. That is the only workaround BTCPay gives for LND deployments.

Nov 7, 2026. First published. BTCPay confirms exploitation and stolen funds; fixed in 2.4.2 since August 7; not on CISA KEV.

• BTCPay Server security advisory for 2.4.2 (posted Aug 7, 2026, updated Nov 2, 2026)
• BTCPay Server 2.4.2 release notes (Aug 7, 2026)
• CVE record for CVE-2026-119757 (VulnCheck CNA, Nov 5, 2026) and VulnCheck advisory
• NIST NVD: CVE-2026-119757 (Received, checked Nov 7)
• CISA Known Exploited Vulnerabilities catalog (checked the November 6, 2026 catalog release)