ACINQ has released Eclair version 0.14.4, a security update for its Bitcoin Lightning node software that blocks a browser-based route for sending authenticated commands to a node. According to CryptoSlate, the fix is designed to prevent malicious webpages from using credentials already stored in an operator’s browser.
How the browser exposure worked
The issue required several conditions to be present. An Eclair API had to be enabled and reachable by the operator’s browser, while that browser also needed to have the node’s HTTP Basic authentication credentials cached.
Under those circumstances, a malicious webpage could submit a standard HTML form to the API. The browser would attach the saved credentials automatically, allowing the authenticated request to reach the node. The webpage could not read the API response, but the command itself could still be processed.
Eclair’s node API can expose operational functions including reading node status, opening and closing Lightning channels, and sending or receiving payments. That made the browser route a security concern for affected configurations.
The patch and its effect on interfaces
Version 0.14.4 rejects API requests that contain an Origin header, returning HTTP status 403 before the request reaches the API route. The check applies regardless of the header’s value.
This change also affects legitimate browser-based interfaces, including frontends hosted at the same origin as the API. Those interfaces now require an intermediary backend rather than connecting directly from the browser to Eclair.
Command-line use continues to work normally. The maintainers said curl and eclair-cli do not send the Origin header, so their usual API requests are not affected by the browser-focused change.
The Origin check is not a replacement for authentication or network controls. A non-browser client can omit the header, meaning that the absence of Origin alone does not prove that a request is authorized. Eclair maintainer pm47 said the API should remain bound to loopback, limiting access to the local machine.
Upgrade guidance and wider release changes
The browser protection was merged on September 15 through pull request #3380 and is included in the release published on October 15. The same version also contains repairs involving funding fees and signers, which CryptoSlate had covered on October 12.
Maintainers recommend upgrading. Operators can stop Eclair, install version 0.14.4 and restart it without closing their Lightning channels.
Moneyiar market picture
Moneyiar data at the stated times shows mixed performance among the listed digital assets:
- Nexus (NEX): $0.0000007051, down 4.07% over 24 hours and 13.47% over seven days, as of October 17, 2026, at 21:59 (+03:30).
- Light (LIGHT): $0.1672899542, up 1.73% over 24 hours but down 9.40% over seven days, as of September 14, 2026, at 02:53 (+03:30).
- Alchemy Pay (ACH): $0.0052738777, down 4.31% in 24 hours and 12.75% in seven days, as of October 17, 2026, at 21:59 (+03:30).
- Request (REQ): $0.0535079909, up 4.07% over 24 hours and down 2.50% over seven days, as of October 17, 2026, at 21:58 (+03:30).
