ACINQ, the team behind the Eclair Lightning node software, has released two security updates in five days to address vulnerabilities that could have allowed peers to steal funds or disrupt payments. The first release, Eclair v0.14.4, landed on October 15, 2026, followed by v0.14.5 on October 20, 2026. Node operators are advised to upgrade immediately.
Cross-origin request forgery in the API
The headline fix in v0.14.4 targets a cross-origin request forgery vulnerability in the node’s API. The API relied on HTTP Basic authentication, and web browsers often cache these credentials. A malicious website could exploit this by quietly sending commands to the node through the operator’s own browser, piggybacking on the stored credentials. According to the release details, forged requests could trigger channel management actions and unauthorized payments without the operator’s direct oversight.
How the patch works
Eclair v0.14.4 now rejects API requests that carry an “Origin” header. Browsers attach this header when a webpage sends a request to another site, while command-line tools generally do not. As a result, operators who manage their nodes from a terminal can continue as before, but direct browser access to the API is shut off. Those running browser-based dashboards will need a custom backend to relay requests to the node.
The release also bundles earlier fixes for funding-fee and signer-related issues, with merge dates for the prior changes running up to September 15, 2026.
Peer-related flaws fixed in v0.14.5
Five days later, ACINQ issued Eclair v0.14.5 to address additional security flaws tied to peer behavior. On Lightning, a peer is another node with which you share a payment channel, and the protocol is designed so that peers can transact without fully trusting each other. Developers say the flaws could have allowed peers to steal funds or disrupt payments. No confirmed fund losses have been reported from the vulnerabilities fixed in the recent releases.
Why Eclair matters
The Lightning Network is a payment layer built on top of Bitcoin, designed to make small, fast Bitcoin transactions practical by moving most activity off the main chain and into payment channels between nodes. Because Lightning nodes hold live funds in channels, they are essentially hot wallets that interact with other nodes continuously. Any bug in how they authenticate commands or handle peer messages is a direct risk to funds.
What operators should do
Eclair node operators should upgrade to v0.14.5, which includes the latest peer-related fixes on top of the API hardening in v0.14.4. Those who built browser-based control panels will need to set up a backend intermediary, as Eclair will no longer accept browser-originated API calls directly.
