CVE-2019-12998: Elementsproject C-Lightning

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "It can be used for testing, but it should not be used for real funds."

Affected products

• Elementsproject C-Lightning: before 0.7.1 (fixed in 0.7.1)

Published 2020-01-31. Last modified 2026-06-17.