BTCPay Server 2.4.5 restricts outbound requests and tightens permissions
The merchant-payment server hardened its network-request boundary and access to invoice and refund functions.
BTCPay Server released version 2.4.5 on October 6, 2026. The update blocked outbound requests to private-network destinations by default and tightened permissions associated with invoices and refunds.
A merchant server can initiate network requests while interacting with other services. If that ability is insufficiently constrained, externally influenced requests can reach systems that were intended to remain accessible only inside a private network. Restricting destinations reduces that route across the server's network boundary.
Invoice and refund permissions address another boundary: which users and applications can perform sensitive merchant operations. Those controls matter even when the Bitcoin payment itself settles correctly.
The release documented hardening of the software surrounding self-hosted Bitcoin commerce. Operating one's own payment infrastructure removes some intermediary dependencies, but still requires careful separation of network access and administrative authority.