Bitcoin Lightning node operators have a security update to review. ACINQ released Eclair v0.14.4 on October 15, adding a safeguard against web pages sending authenticated commands to a node’s API. The risk arises when the API is enabled and reachable from an operator’s browser, which has already cached HTTP Basic authentication credentials.
A malicious page could submit a form that the browser sends with those saved credentials. The attacker would not need to read the API response for the command to execute. Eclair now rejects API requests containing an #Origin header. Standard command-line tools remain supported, while browser-based dashboards require a separate backend.
The maintainers recommend upgrading and say existing Lightning channels do not need to be closed. They have not disclosed confirmed exploitation or a loss figure. This is a targeted $BTC Lightning infrastructure issue, not a Bitcoin mainnet breach
A malicious page could submit a form that the browser sends with those saved credentials. The attacker would not need to read the API response for the command to execute. Eclair now rejects API requests containing an #Origin header. Standard command-line tools remain supported, while browser-based dashboards require a separate backend.
The maintainers recommend upgrading and say existing Lightning channels do not need to be closed. They have not disclosed confirmed exploitation or a loss figure. This is a targeted $BTC Lightning infrastructure issue, not a Bitcoin mainnet breach