Core Lightning urges urgent upgrade to address critical vulnerabilities

Upgrade advisory following vulnerability reports

Over a 10-day period, multiple AI-generated reports of vulnerabilities were submitted to the Core Lightning development team from various sources. Blockstream is a leading blockchain technology company known for its open-source contributions and supporting Bitcoin infrastructure projects like Core Lightning.

Project developers and open-source contributors have been actively working to verify these reports and assess potential risks to the network. Given the gravity of the situation, the team initially intended to issue a point release with immediate fixes. However, the strategy changed in favor of releasing signed binaries containing security patches while withholding public details of the vulnerabilities for two weeks.

During this embargo period, Core Lightning maintainers strongly urged all operators to upgrade their nodes as soon as the fixed binaries become available.

Operators who do not perform the upgrade have been advised to immediately restart their nodes, as previous releases, including version 26.04, will not be supported throughout the ongoing security response process.

Reaction from developers and the community

Calle, a developer active in the Cashu ecosystem, described the reported vulnerabilities as “critical” and called on operators to shut down their Core Lightning nodes until the security issues are resolved. Christian Decker, a long-time Core Lightning contributor, explained that the development team plans to release ready-to-run binaries, while keeping the corresponding source code patches private for 14 days, to prevent attackers from analyzing the fixes to develop exploits.

The project initially communicated the emergency through unofficial channels, such as Discord, leading to criticism from some users about the lack of prompt public communication. Core Lightning subsequently issued an official operator warning.

Full details about the vulnerabilities, including their potential impact and how they might be exploited, remain undisclosed to the public during the embargo period.

Core Lightning’s most recent stable release is version 26.06.6, made available to the public in July. The next scheduled major release, v26.09, is expected in September.

Mini dictionary: Core Lightning (CLN), an implementation of the Lightning Network protocol, is developed and maintained by Blockstream. It provides a scalable and fast payment solution for Bitcoin transactions using payment channels.