BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-119757BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

9.3 CRITICALEPSS 0.53%Not in KEVNVD: Received

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.3CRITICAL4.0VulnCheck (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8CRITICAL3.1VulnCheck (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID
CVE-2026-119757
Status
Received
Assigner (CNA)
VulnCheck
Published
Nov 5, 2026
Last modified
2026-11-05 22:17 UTC
Weaknesses
  • CWE-552 · Files or Directories Accessible to External Parties
  • CWE-522 · Insufficiently Protected Credentials

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-07 20:33 UTC.