ACINQ urged Bitcoin Lightning node operators to upgrade to Eclair 0.14.5 after patching security flaws that developers said could allow peers to steal funds or disrupt payments. Released on Oct. 20, 2026, the update followed version 0.14.4 on Oct. 15 and marked Eclair’s second security-focused release in five days. Eclair powers Lightning nodes that hold Bitcoin in payment channels and route transactions across the network. Version 0.14.4 blocked API requests carrying an Origin header after a cross-origin request forgery vulnerability allowed a malicious website to use cached HTTP Basic authentication credentials in a browser to send unauthorized channel-management commands and payments. Command-line tools continue to work, but browser-based dashboards now require an intermediary backend. The releases also include earlier funding-fee and signer-related fixes. ACINQ credited security researchers Nuhiat-Arefin and mptfire with responsibly reporting the issues and reported no confirmed attacks or financial losses. Operators can upgrade without closing existing channels, while signed files and SHA-256 checksums help verify downloads. ACINQ has not published a detailed breakdown of affected older versions or the newer peer-related exploit mechanisms.