ACINQ released Eclair 0.14.5 on October 20, adding security hardening to its Bitcoin Lightning software. The release announcement recommends that operators upgrade because malicious nodes could exploit some of the issues addressed.
TL;DR: The patch follows another security release five days earlier. Operators need to review both the upgrade and any integrations affected by the earlier browser-access change.
A second patch follows changes to API access
Version 0.14.5 credits responsible disclosures from two researchers and states that the upgrade remains compatible with earlier Eclair versions. Its instructions call for stopping the software, replacing it and restarting; closing existing payment channels is not required.
The announcement does not describe a confirmed theft or provide a complete public account of every issue. Its security recommendation therefore should not be converted into a claim that Lightning as a whole has been compromised.
The preceding 0.14.4 release notes describe a concrete operational change: Eclair’s API rejects requests carrying an Origin header, preventing direct access from web browsers. Command-line tools remain usable, while operators with browser front ends need an intermediary backend.
The developers explain that browsers can reuse cached HTTP authentication on cross-site requests. A hostile webpage could consequently cause an authenticated API action even without being able to read the response. The restriction addresses that route by distinguishing browser requests from ordinary command-line access.
That makes the change relevant beyond the node binary. An operator’s dashboard or payment-management interface may depend on how it connects to the API, so a successful restart alone does not establish that every surrounding service still works.
Payment reliability includes the software around the channel
Eclair’s operating documentation describes its connection to Bitcoin Core and the wallet used to fund and close channels. It also separates wallet backups from backups of Eclair’s seeds and channel database. The channel database changes as payments are sent or received, giving it a different backup cadence from the original seed material.
Those details illustrate why running a Lightning node involves more than maintaining a Bitcoin balance. The software must track changing channel state, communicate with peers and interact with a blockchain backend. Each connection creates dependencies that an upgrade can affect.
For merchants and payment providers, the practical question is whether the entire payment path still behaves as expected after maintenance. Invoice handling, routing, backend connectivity and administrative access serve different functions; checking one does not substitute for checking the others.
The release provides a specific maintenance action for Eclair operators. It offers no evidence about Bitcoin’s market price, network-wide losses or a change to the supply rules. Its significance is operational: security work on widely connected payment software continues after a channel has been opened and funded.
Written by the News Desk and edited by Samuel Rae.