Understand custody · Access and authority
When a Wallet Name Becomes a Command
In September 2026, Bitcoin Core's main branch received a fix for a bug that could let a wallet name alter an operating-system command in a narrow server configuration.
EDITORIAL OVERVIEW · Prepared by the project editors from the sources listed below.
A vulnerability with several required conditions
The bug did not allow an arbitrary Bitcoin peer to attack a node over a normal P2P connection. Exploitation required a non-Windows system, a configured -walletnotify command, authenticated RPC access, and permission to create wallets.
The attacker also needed to create a wallet with a crafted name, obtain an address for it, and trigger the notification with a transaction. Only this combination opened a path to an additional shell command.
What walletnotify is for
A Bitcoin Core operator can configure a command to run when a wallet transaction appears. It is commonly used for accounting, alerts, and integrations with other services.
A command template may include the wallet name. That value should remain plain text, but a change introduced in Bitcoin Core 24.0 allowed particular replacement characters to disrupt shell escaping and alter the command's structure.
Why authenticated RPC still needs boundaries
An RPC user already has access to some node functions, but permission to create a wallet is not the same as permission to execute arbitrary commands as the Bitcoin Core process account.
That boundary matters when RPC access is given to an administration panel, internal service, or plugin. The bug allowed an authorized action inside Bitcoin Core to cross into the operating system.
Merged code is not yet every installed release
The fix restored literal replacement: special characters in a wallet name should no longer change the command. A regression test now uses a deliberately hostile name, and the reviewed change was merged into the main branch on September 2, 2026.
A merged change is not automatically present in every installed binary. Operators should follow official release notes rather than installing an untrusted build for a single fix.
What node operators should review
If Bitcoin Core is used as an ordinary desktop wallet and RPC is not exposed to other applications, this scenario is generally not applicable. Server operators should review their use of -walletnotify, RPC accounts, wallet-creation permissions, and the privileges of the operating-system user running Bitcoin Core.
RPC should not be exposed to the public internet, and each service should receive only the permissions it needs. The lesson is not that wallet names are inherently dangerous. It is that data inside an application must never silently become a command outside it.
Permission to create a wallet should never become permission to execute operating-system commands.
Sources and verification
Technical material for node operators. The described scenario is not available to an ordinary P2P peer without authenticated RPC access and a specific walletnotify configuration.
Unless stated otherwise, the text, conclusions, structure and editorial arrangement were created by the project editors. Facts, quotations and source materials remain attributable to their authors and rights holders.
← Back to the rubric