CVE-2026-119757 is a critical (CVSS 3.1 9.8) information disclosure bug in BTCPay Server before 2.4.2. Unauthenticated remote attackers can download a Lightning node's .macaroon credential files. Depending on which macaroon is exposed and how the node is configured, an attacker may be able to use those files to steal funds.
What Is It
BTCPay Server versions before 2.4.2 have an information disclosure flaw that exposes .macaroon credential files for a connected LND (Lightning Network Daemon) node. Release candidates of 2.4.2 are also affected. An attacker needs no login and no user interaction to get the files.
A macaroon is an LND credential, and what it allows depends on the permissions it carries. LND issues macaroons with different scopes, such as read-only, invoice-only and admin. If an admin-level macaroon is exposed and the node's RPC interface is reachable, an attacker could gain broad control of the node, including the ability to move funds. A macaroon with narrower permissions would give correspondingly less access.
VulnCheck reported the issue and mapped it to two weaknesses: - CWE-522: Insufficiently Protected Credentials - CWE-552: Files or Directories Accessible to External Parties
Why It Matters
This bug can lead to theft of funds. The NVD record says exploitation results in "theft of funds from affected deployments." How much damage an attacker can actually do depends on which macaroon they retrieve and whether they can reach the LND node to use it.
The severity scores reflect the potential impact:
- CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 4.0: 9.3 Critical
Both vectors describe an attack over the network with low complexity, no privileges needed and no user interaction. Each rates the impact on confidentiality, integrity and availability as high, which reflects the worst case.
Exploitation status: CVE-2026-119757 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. The supplied data does not include any other public report of exploitation. NVD lists the record as "Received", meaning it has not been analyzed yet.
What's Vulnerable
- Vendor/Product: BTCPay Server
- Affected versions: every version before 2.4.2 (semver), including the 2.4.2 release candidates
- Exposure condition: deployments that integrate an LND node, whose macaroon files can be retrieved
- Repository: https://github.com/btcpayserver/btcpayserver
NVD has not published CPE identifiers for this CVE yet.
Patch Status
The fix is in BTCPay Server 2.4.2. Operators should move to the final 2.4.2 release. Running a 2.4.2 release candidate is not enough because those builds are also affected.
CISA has issued no required action because the CVE is not in the KEV catalog. Check the vendor's security advisory for remediation guidance beyond the upgrade.