Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119757— BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

Quick assessment

Affected
BTCPay Server BTCPay Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

BTCPay Server 2.4.2 之前的版本（包括 2.4.2 的发布候选版本）存在信息泄露漏洞。该漏洞允许未经身份验证的远程攻击者获取 LND（Lightning Network Daemon）节点的 .macaroon 凭证文件。攻击者可利用泄露的 macaroon 完全控制 LND 节点，包括转移资金，从而导致受影响部署中的资金被盗。

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119757

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对外部实体的文件或目录可访问
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
BTCPay Server BTCPay Server 0 ~ 2.4.2 -

II. Public POCs for CVE-2026-119757

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119757

请登录查看更多情报信息。

Other References for CVE-2026-119757 (3)

IV. Related Vulnerabilities

Same weakness: CWE-552