From db39de5601094dc3f0b15ce4759e1b88025403c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C5=91rinc?= Date: Tue, 1 Sep 2026 11:30:27 -0700 Subject: [PATCH] doc: add `-walletnotify` security note Co-authored-by: maflcko <6399679+maflcko@users.noreply.github.com> --- doc/release-notes-36048.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 doc/release-notes-36048.md diff --git a/doc/release-notes-36048.md b/doc/release-notes-36048.md new file mode 100644 index 00000000000..dc912207707 --- /dev/null +++ b/doc/release-notes-36048.md @@ -0,0 +1,8 @@ +Wallet +------ + +* On non-Windows systems, an authenticated RPC caller allowed to create wallets + could execute arbitrary commands as the node process account when + `-walletnotify` was configured, by crafting a wallet name with regex + replacement characters. Wallet notification placeholder replacement now + treats wallet names literally. (#36048)