lnd developer recommends urgently updating lnd, btcd, tapd and litd because of CVE-2026-111943 (certificate authority compromise)
A post by the lead lnd developer discusses CVE-2026-111943 — the compromise of certificate authority eMudhra, which means the root certificate trusted in the builds can no longer be considered reliable. Users of lnd, btcd, tapd and litd are affected: the compromised CA undermines trust in the daemons' TLS connections, the channel carrying RPC connections and the node's external traffic. Releases built with a corrected trust set have already been published for all four projects; the alternative is to rebuild them yourself with Go 1.27.3.
Update lnd, btcd, tapd and litd to the releases linked in the post, or rebuild your binaries with Go 1.27.3 — do this today, without waiting for a scheduled maintenance window. If you build from source yourself, update the Go toolchain to the specified version before rebuilding.