Security1 publisher3 min readPublished
Alby's cloud guides told wallet owners to open the port its takeover flaw needs
The flaw in Alby Hub v1.7.0 through v1.18.5 only reaches wallets whose management interface faces the internet, and that is how Alby's DigitalOcean and Hetzner guides had readers run it. The fix shipped in August 2025.
The Watch · Security desk
What happened
- Alby warned of a critical flaw in its self-hosted Lightning wallet, Alby Hub, that could have let an attacker take over a wallet and send its funds, but only where the owner made the Hub reachable from the internet.
- Alby says one user has been affected so far, has not said whether that user lost money, and has not said what the flaw is, promising full details later.
- A documentation change merged September 7 also switched the project's Docker file from publishing port 8080 to every address to binding it to the machine itself.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The people at risk are the ones who followed Alby's cloud instructions rather than the ones who ignored them, so the vendor's own guidance sized the reachable population.
- constraint For anyone whose Hub was exposed on an affected build, credential rotation becomes part of recovery rather than hygiene, and the advisory gives them no way to confirm an attacker is gone.
- decision With the mechanism withheld, an owner of a previously exposed Hub chooses between moving funds to a fresh wallet now and waiting for the writeup that would say whether a login was ever required.
- contradiction Alby's documentation now warns against public exposure while its cloud guides walk readers into it, so two Alby pages read on the same day give an owner two different answers.
Alby puts the network step before the version step, and its third step explains why. Owners on v1.18.5 or older are told to stop outside access to the management interface first, then update to v1.24.0 [7]. For the narrower group whose Hub was both on an affected build and reachable from outside, there is more: change the unlock password after the update, and write to [email protected] [9]. Alby has not said whether updating alone ends access an attacker already had, and no published source explains what the password change is meant to undo [10]. Closing the port is the one action that works whatever the bug turns out to be.
Alby has not disclosed what the bug is. Alby says it will publish full details later under responsible disclosure, and thanked researchers who reported other issues fixed in the latest release [6]. So no owner can match a log line against a known request pattern, and the victim count stands where Alby left it: one user, who reported the details to the company, with no statement on whether funds were lost [5].
v1.19.0, the fix, was published on August 29, 2025 [4]. The warning is dated September 9 and treats a November 2025 wallet-emptying as earlier history [14][17], which puts the advisory in September 2026 at the earliest and the fixed release at least twelve months old when it went out [21]. A Hub still running v1.18.5 has sat out six minor release lines, v1.19 through v1.24 [22].
The exposure was documented rather than improvised. The documentation change merged September 7 says several of the setup guides had described the server as "running on localhost when it actually listens on all network interfaces" [11]. Two days later the cloud guides had not caught up. Alby's DigitalOcean guide told readers to keep the server's public address switched on because it is "needed so you can open Alby Hub in your browser," then to open the Hub at that address [15]. The Hetzner guide walked through a firewall rule for port 8080 with the source set to "Any IPv4 and Any IPv6, or your own IP address for better security," and its example Docker file published the port to every address [16]. The README in the current release still carries no warning [13]. Alby's remediation advice inverts both: bind Docker to 127.0.0.1:8080:8080, and scope the port 8080 rule to your own address [8].
November 2025 was a different mechanism by Alby's account, an unfinished setup with no unlock password yet, which the attacker completed [18], on a machine Alby described as "reachable publicly on the clearnet, so it could be accessed from the outside" [17]. It was a different bug, but the same precondition applied. The change that held afterwards was not a version bump: Umbrel put Alby Hub behind Umbrel's own login, which had been switched off for that app [19]. Package sources now run ahead of owners, with Umbrel's store installing v1.24.0 and Alby's own Umbrel listing v1.21.4, which describes what a fresh install gets and not what is running on a box set up in early 2025 [20].
Alby's warning gives no count of internet-facing Hubs, but its guidance is the countable quantity, and on September 9 it pointed both ways.
What to watch
- Alby's promised technical writeup: whether the flaw needed a valid login decides how reachable an exposed Hub was without credentials.
- Whether the DigitalOcean and Hetzner guides and the current release README are rewritten to carry the exposure warning.
- Whether the affected-user count moves past one, and whether Alby states if bitcoin was actually sent.