Eclair Ships Two Security Releases in Five Days for Lightning Nodes
ACINQ issued two Eclair security releases in five days. v0.14.4 closes a browser-based API flaw that could trigger unauthorized payments, and v0.14.5 fixes peer-behavior bugs that could let peers steal funds. No losses have been reported.
Operators of Eclair Lightning nodes have been told to upgrade after ACINQ, the team behind the software, issued two security releases within five days. The second, Eclair v0.14.5, arrived on October 20, 2026. It addresses flaws tied to peer behavior that developers say could have allowed peers to steal funds or disrupt payments.
No confirmed fund losses have been reported from the vulnerabilities fixed in the recent releases.
The browser-based API flaw
The first release, v0.14.4, landed on October 15. Its headline fix targets a cross-origin request forgery (CSRF) vulnerability in the node's API. The API relied on HTTP Basic authentication, and browsers can cache those credentials. A malicious website could therefore send commands to the node through the operator's own browser.
According to the release details, forged requests could trigger channel management actions and unauthorized payments.
The fix rejects API requests that carry an Origin header. Command-line tools keep working, but direct browser access to the API is now shut off. Operators who run browser-based dashboards will need a custom backend intermediary to relay requests to the node, which means extra work for those setups.
v0.14.4 also bundles earlier funding-fee and signer-related fixes, with merge dates running up to September 15, 2026.
Peer-behavior fixes in v0.14.5
The v0.14.5 release deals with a different class of problem: security flaws tied to how remote peers behave on the network. Developers say those flaws could have let peers steal funds or disrupt payments.
Public accounts are not fully consistent on which version introduced the peer-related bugs, with some descriptions pointing to v0.14.4. The guidance is unambiguous either way: anyone running an older version should move to v0.14.5.
Upgrading does not require closing channels. Operators do have to stop and restart Eclair.
What it means for operators
The two releases address different parts of the stack. One closes a path from the operator's own browser into the node. The other covers risk from counterparties on the network. For anyone running Eclair, the recommended step is to upgrade to v0.14.5.
Lightning node software has drawn security scrutiny elsewhere. We reported that Core Lightning told node operators to go offline with no patch available, and that a critical BTCPay Server flaw allowed fund theft from Lightning nodes, with a patch since released. In Eclair's case, fixes are available and no losses have been reported, but the browser restriction means dashboard users should plan their backend changes before upgrading.
