Eclair 0.14.4 blocks browser attacks on Lightning nodes

ACINQ’s Eclair v0.14.4 blocks browser-based attacks that could send authenticated commands to Bitcoin Lightning nodes through cached HTTP Basic credentials. Command-line access remains unaffected.

The issue affected operators who had enabled Eclair’s API and made it reachable from a web browser. A malicious webpage could submit a standard HTML form to the API, prompting the browser to attach saved credentials automatically. The attacker could not read the response, but the authenticated command could still reach the node.

Eclair’s API can expose node information and perform actions such as opening or closing payment channels and sending or receiving payments. Version 0.14.4 returns an HTTP 403 error before processing an API request whenever it contains an Origin header, regardless of the header’s value.

The restriction affects legitimate browser interfaces, including those hosted at the same origin as the API. These interfaces now need a backend intermediary to communicate with Eclair. Requests from curl and eclair-cli generally do not include an Origin header and continue to work normally.

The Origin check does not replace authentication or network controls. Eclair maintainer pm47 recommends keeping the API bound to loopback so it can be reached only from the local machine. Authentication should remain enabled because a non-browser client can omit the Origin header.

The fix was merged Sept. 15 in pull request #3380 and is included in v0.14.4. The release also contains repairs related to funding fees and signers. Maintainers recommend stopping Eclair, installing the update and restarting the node. Existing Lightning channels do not need to be closed.