CryptoSlate
Core Lightning maintainers are urging node operators to install v26.06.10 as soon as practical to address channel-security, payment-resolution and remote-access flaws. The update adds signature checks for dual-funded channel openings and splicing, and rejects channel opens with a peer's dust limit above 5,000 satoshis.
Why it matters
Lightning channels allow Bitcoin payments between participants without recording every payment directly on the blockchain. The changelog says the previous handling of dust limits could let a peer trim a node's balance into fees during a forced close. A separate payment-resolution fix addresses a case where a node could fail a live payment upstream while its peer could still claim it.
The release also fixes a bypass of restrictions on remote-command parameters. Maintainers recommend binding commando credentials, known as runes, to the intended application's node ID, blacklisting credentials operators cannot account for and replacing them with more tightly restricted ones.
Market impact
The warning concerns operators running unpatched Core Lightning software, not a flaw attributed to Bitcoin itself. The release notice does not establish that the vulnerabilities were exploited.
Dual funding remains experimental, and maintainers discourage zero-confirmation channels with untrusted peers. Operators who have run the master branch cannot downgrade to the 26.06.x series because their database schema is newer.
Frequently asked questions
-
Which Core Lightning version do maintainers recommend?
Maintainers urge operators to install v26.06.10 as soon as practical. The release addresses channel-security, payment-resolution and remote-access flaws.
-
How could the previous dust-limit handling affect a channel balance?
The changelog says a peer could trim a node's balance into fees during a forced close. The update rejects channel opens when a peer proposes a dust limit above 5,000 satoshis.
-
What should operators do with their commando credentials?
Maintainers recommend binding credentials to the intended application's node ID, blacklisting credentials operators cannot account for and replacing them with more tightly restricted ones.
-
Were the Core Lightning flaws exploited?
The release notice does not establish that the vulnerabilities were exploited.
-
Can operators who ran the master branch downgrade to 26.06.x?
No. Nodes that have run the master branch cannot downgrade to the 26.06.x series because their database schema is newer.
CoinDesk
TheBlock
WatcherGuru
WuBlockchain