Eclair v0.14.4, released October 15 by ACINQ, patches a vulnerability that could let malicious webpages issue authenticated commands to a Bitcoin Lightning node through an operator's browser.
The exposure required specific conditions: an enabled Eclair API reachable by the operator's browser and HTTP Basic authentication credentials already cached in that browser. Eclair's node API can read node state, open and close channels, and send and receive payments.
How the Attack Worked
According to Eclair's release notes, a malicious webpage could submit a plain HTML form to the node's API. The browser would automatically attach the saved credentials to the request. While the attacker could not read the response, the authenticated command would still execute on the node.
The Fix
The patch rejects API requests that carry an Origin header, blocking the browser-based attack route. The fix merged on September 15 in pull request #3380.
The restriction affects legitimate browser interfaces, including those hosted at the same origin as the API. These frontends now require an intermediary backend between the browser and Eclair.
Command-line access remains unaffected. Tools like curl and eclair-cli do not send the Origin header, so their API requests continue to work normally.
Additional Security Measures
Eclair maintainers emphasize that authentication and network restrictions remain essential. The Origin check alone does not establish authorization, as non-browser clients can omit the header. The API should remain bound to loopback, restricting network access to the local machine.
Operators can upgrade by stopping Eclair, installing the update, and restarting without closing their Lightning channels.
