lnd · LND
Lightning Labs: certificate authority compromise requires updates to lnd, btcd, tapd and litd
The project team reports a CVE related to the compromise of the eMudhra certificate authority and strongly recommends that users of lnd, btcd, tapd and litd either move to fresh release binaries or rebuild their own from source using Go 1.27.3. The trusted set of root certificates used by the node's TLS connections and related services is affected. While a node runs an old build, its connections trust certificates from the compromised authority.
Actions to take
Update to the releases linked below today, or rebuild your binaries using Go 1.27.3. Do not put this off until a scheduled maintenance window: the advice comes from the project itself and applies to all four components.