Eclair Ships Two Lightning Security Patches in Five Days

ACINQ, the team behind Eclair — one of the main software implementations of Bitcoin's Lightning Network — has pushed out two security releases in the space of five days, and is urging everyone running an Eclair node to upgrade to the newest version, v0.14.5, as soon as possible.

The first fix, v0.14.4, landed on October 15. It closed a cross-origin request forgery hole in Eclair's administrative HTTP API. In plain terms: if a node operator visited a malicious webpage in a browser that had their node's API login cached, that page could quietly send authenticated commands to the node — potentially triggering payments or opening, closing and updating channels without the operator ever clicking anything. Version 0.14.4 blocks web pages from reaching the node's API through the operator's browser in this way.

The Second Patch: Hostile Peers

Just five days later, on October 20, ACINQ shipped v0.14.5. This release addresses a different class of problem: vulnerabilities in how Eclair handles messages from the other nodes it is connected to. According to ACINQ, some of these flaws could be exploited by a hostile channel counterparty to disrupt payment routing or, in the worst cases, steal funds locked in a channel.

That is what makes this kind of bug serious for Lightning specifically. A Lightning node is effectively a hot wallet with automation on top — it holds real bitcoin in channels and constantly signs updates to who owns what. Any weakness in how it authenticates commands or validates peer messages is a direct line to that money.

What Operators Need to Do

The good news is that the bugs were found and fixed before any known exploitation, and the upgrade is relatively painless. Existing channels can stay open — there is no need to close channels and move funds on-chain. Operators do need to stop Eclair, install v0.14.5, and restart it. Anyone who already upgraded to v0.14.4 last week still needs to upgrade again, as 0.14.4 does not include the peer-level fixes.

Part of a Busy Season for Lightning Security

Eclair's double release caps off an unusually active few months for Lightning security work. In September, three of the major Lightning implementations — Lightning Dev Kit (LDK), Core Lightning (CLN) and Eclair itself — each shipped critical fixes within roughly two weeks of one another, with no confirmed losses reported. Core Lightning developers later warned operators to move to v26.06.8 after reports of active attempts to exploit older nodes, following a wave of vulnerability reports — many of them AI-assisted — that the team had been working through since August.

For Bitcoin's main layer-two payment network, the pattern is a reminder of both its strengths and its trade-offs. Responsible disclosure and fast patching are working as intended, but Lightning nodes are complex, always-online software holding live funds, and they only stay safe if operators keep them up to date. If you run Eclair — directly or through a service built on it — now is the time to check your version number.