Eclair Urges Its Software Operators to Upgrade After Security Warning

ACINQ released version 0.14.5 of its Eclair Lightning software on Oct. 20, urging operators to upgrade because malicious nodes could exploit some of the issues fixed.

Eclair is ACINQ’s implementation of Lightning, a payment network that connects participants through Bitcoin (BTC)-funded payment channels. The update followed Eclair’s v0.14.4 API change, released Oct. 15. That release rejected API requests with an Origin header, blocking browser-based requests while leaving command-line access available.

Version 0.14.5 gives no details about the vulnerabilities or affected earlier versions, and it lists no confirmed attacks or losses. The warning is specific to Eclair and does not establish that other Lightning implementations are affected. Nuhiat-Arefin and mptfire received credit for responsible disclosures.

Operators can install the update by stopping Eclair, installing the new version and restarting the software. Existing channels can remain open during that process, and version 0.14.5 is compatible with earlier Eclair releases.