Description
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bitcoin | 31.0-2.1 | openSUSE-SU-2026:11073-1 |
| openSUSE Leap 16.0 | bitcoin | 27.1-bp160.2.1 | openSUSE-SU-2026:21149-1 |
Advisories 2
- openSUSE-SU-2026:21149-1 Security update for bitcoin SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:11073-1 bitcoin-qt6-31.0-2.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026