Eclair addresses bugs that risk Lightning Network thefts

ACINQ, the team behind the Eclair Lightning node software, has spent the past week patching security holes. Developers say bugs in Eclair v0.14.4 could allow peers to steal funds or disrupt payments.

The company has responded with two releases in five days. For node operators, the message is simple: upgrade now.

What ACINQ fixed

The first release, Eclair v0.14.4, landed on October 15, 2026. Its headline fix targets a cross-origin request forgery vulnerability in the node’s API.

Web browsers often remember login credentials so users don’t have to keep retyping them. In Eclair’s case, the API relied on HTTP Basic authentication, and those credentials could sit cached in a browser.

That cache created an opening. A malicious website could quietly send commands to the node through the operator’s own browser, piggybacking on the stored credentials.

The potential damage was not cosmetic. According to the release details, forged requests could trigger channel management actions and unauthorized payments, all without the operator’s direct oversight.

How the patch works

ACINQ’s fix is blunt but effective. Eclair v0.14.4 now rejects API requests that carry an “Origin” header.

Browsers attach that header when a webpage sends a request to another site. Command-line tools generally do not.

The result is a clean split. Operators who manage their nodes from a terminal keep working as before, while direct browser access to the API is shut off.

That choice has a cost for anyone running a browser-based dashboard. Those frontends now need a custom backend sitting in the middle, relaying requests to the node rather than talking to it directly.

The release also bundles earlier fixes. These address funding-fee and signer-related issues, with merge dates for the prior changes running up to September 15, 2026.

A second release, five days later

ACINQ wasn’t finished. On October 20, 2026, the team issued Eclair v0.14.5, addressing additional security flaws tied to peer behavior.

On Lightning, a peer is another node you share a payment channel with, and the protocol is designed so that peers can transact without fully trusting each other. Developers say the flaws could have allowed peers to steal funds or disrupt payments.

No confirmed fund losses have been reported from the vulnerabilities fixed in the recent releases.

Why Eclair matters

The Lightning Network is a payment layer built on top of Bitcoin. It aims to make small, fast Bitcoin transactions practical by moving most activity off the main chain and into payment channels between nodes.

Because Lightning nodes hold live funds in channels, they are essentially hot wallets that talk to strangers all day. Any bug in how they authenticate commands or handle peer messages is a direct line to money.

What this means for operators and the network

The immediate stakeholders are Eclair node operators, and their to-do list is short. Anyone still on an older version should move to v0.14.5, which includes the latest peer-related fixes on top of the API hardening in v0.14.4.

Operators who built browser-based control panels face more work. They will need to stand up a backend intermediary, since Eclair will no longer accept browser-originated API calls directly.

The research findings frame the response as proactive, arguing that tighter API security and quick fixes may support adoption of Lightning integrations over time.