Core Lightning has urged Bitcoin Lightning node operators to upgrade to version 26.06.7 after developers confirmed multiple security vulnerabilities in earlier releases of the open-source payment software. The advisory followed a surge in AI-generated security reports that helped surface the weaknesses.

Version 26.06.7 was released on Aug. 28, with the vulnerability details initially withheld under a two-week embargo. The delay gave operators a window to install the fixes before attackers could study the changes — a coordinated-disclosure pattern common in open-source security work, where patches ship first and the technical specifics become public once the window closes. According to CoinDesk, developers had found no evidence that the flaws were actively exploited at the time of the warning.

Why the update matters

Core Lightning, commonly known as CLN, enables operators to send, receive and route Bitcoin payments across the Lightning Network, a second layer where node software maintains payment channels and tracks each one's current balance. A compromised node can place funds held in Lightning payment channels at risk.

For operators unable to upgrade immediately, developers recommended restarting CLN with the –offline option instead of shutting the machine down. Offline mode blocks communication with other Lightning nodes while allowing the software to keep monitoring the Bitcoin blockchain.

The distinction is significant: a running node can detect certain attempts to close channels using outdated balances, whereas a fully powered-off machine offers no such protection. The project has also ended support for all releases prior to 26.06.7, making the upgrade the central remediation step for affected operators.

Docker users face an extra check

A separate issue surfaced during the initial rollout for operators running Docker. Some Docker images published between Aug. 28 and Sept. 1 displayed version 26.06.7 but did not include the complete security fixes. Core Lightning later refreshed the affected images, and operators who pulled them during the affected window should verify their image digest and obtain the corrected version. Because a digest is a content-based identifier tied to an image's exact contents, checking it can distinguish the corrected rebuild from the incomplete ones even when both display the same version number.

The episode underscores a broader security challenge for Bitcoin infrastructure: AI tools are increasingly uncovering vulnerabilities across open-source projects, accelerating security research while raising the pressure on maintainers to respond quickly. For Lightning operators, the immediate priority remains running a verified, fully patched release rather than trusting the version number displayed by the software.

Source: CryptoMeter io