Eclair addresses bugs that risk Lightning Network thefts

ACINQ, the team behind the Eclair Lightning node software, has spent the past week patching security holes. Developers say bugs in Eclair v0.14.4 could allow peers to steal funds or disrupt payments. The company has responded with two releases in five days. For node operators, the message is simple: upgrade now. What ACINQ fixed The first release, Eclair v0.14.4, landed on October 15, 2026. Its headline fix targets a cross-origin request forgery vulnerability in the node’s API. Web browsers often remember login credentials so users don’t have to keep retyping them. In Eclair’s case, the API relied on HTTP Basic authentication, and those credentials could sit cached in a browser. That cache created an opening. A malicious website could quietly send commands to the node through the operator’s own browser, piggybacking on the stored credentials. The potential damage was not cosmetic. According to the release details, forged requests could trigger channel management actions and unauthorized payments, all without the operator’s direct oversight. How the patch works ACINQ’s fix is blunt but effective. Eclair v0.14.4 now rejects API requests that carry an “Origin” header. Browsers attach ...