Eclair Developers Release Two Security Patches for Lightning Network in Five Days

ACINQ, the team behind the Eclair Lightning node software, has swiftly addressed significant security vulnerabilities in the Lightning Network with two updates released within five days. The first update, Eclair v0.14.4, was launched on October 15, 2026, and focused on fixing a cross-origin request forgery vulnerability in the node’s API.

This vulnerability could allow malicious websites to exploit stored login credentials in web browsers, enabling unauthorized commands to be sent to the node. The update effectively blocks API requests with an 'Origin' header, enhancing security for node operators who manage their systems via command-line tools.

On October 20, 2026, ACINQ followed up with Eclair v0.14.5, which addressed additional security flaws related to peer behavior that could potentially lead to fund theft or payment disruptions. While no confirmed losses have been reported, the proactive response is seen as essential for maintaining the integrity of the Lightning Network.

Node operators are strongly encouraged to upgrade to the latest version to ensure their systems are secure. Those using browser-based control panels will need to implement a backend intermediary to comply with the new security measures.