sec_₿sec.21ideas.org
lnd · LND
Patch availableNode operatorsDevelopers22 October 2026

Lightning Labs: certificate authority compromise requires updates to lnd, btcd, tapd and litd

The project team reports a CVE related to the compromise of the eMudhra certificate authority and strongly recommends that users of lnd, btcd, tapd and litd either move to fresh release binaries or rebuild their own from source using Go 1.27.3. The trusted set of root certificates used by the node's TLS connections and related services is affected. While a node runs an old build, its connections trust certificates from the compromised authority.

Actions to take

Update to the releases linked below today, or rebuild your binaries using Go 1.27.3. Do not put this off until a scheduled maintenance window: the advice comes from the project itself and applies to all four components.