Eclair 0.14.4 blocks browser attack on Lightning node API

ACINQ has shipped Eclair v0.14.4, a security patch for its Bitcoin Lightning node software that stops a malicious webpage from quietly sending authenticated commands to a node through the operator's own browser. The release went out on 15 October, and the maintainers "highly recommend upgrading," noting that some of the fixed issues can be exploited by malicious nodes.

What the browser fix does

Eclair exposes an optional HTTP API that can read node state, open and close channels, and send or receive payments. According to the release notes, as summarised by CryptoSlate, the risk looked like this:

• The operator has the API enabled, reachable from their browser, and has already logged in with HTTP Basic authentication, so the browser caches the password.
• A hostile webpage submits a plain HTML form to the node's API address. The browser attaches the saved credentials automatically.
• The attacker cannot read the reply, but the command itself still reaches the node — a classic cross-site request forgery pattern.

The patch makes Eclair answer HTTP 403 to any API request that carries an Origin header, whatever its value, before the request is processed. The change was merged on 15 September in pull request #3380.

Who is affected

• Command-line users: eclair-cli and curl don't send an Origin header, so normal scripted access keeps working.
• Browser dashboards: any web interface that talks to the API directly — even one hosted on the same origin — now needs a small backend sitting between the browser and Eclair.
• Everyone: the maintainers stress that the Origin check is not authentication. Keep the API password strong and the API bound to the local machine (loopback), not exposed to the network.

The release also bundles other hardening fixes, most credited to contributor erickcestari and the Loupe project. ACINQ says it is fully compatible with earlier versions: stop the node, upgrade and restart, with no need to close channels. We have not seen reports of the browser issue being exploited.

Why it matters

Lightning nodes are hot wallets: the keys that control channel funds sit on an always-online machine, so the attack surface around them matters more than for cold storage. New to the technology? Our explainer what is the Lightning Network covers channels, routing and the risks. Rogue software touching wallets is a theme this week, after an OpenAI test model spent testnet ETH from a wallet it did not own.