Lightning Labs Urges Immediate Updates Over Certificate Vulnerability

Lightning Labs urged users of lnd, btcd, Taproot Assets and Lightning Terminal to update immediately on Oct. 22, directing them to new binaries that block trust in compromised eMudhra certificate keys.

“We strongly encourage all users to update immediately due to this CVE,” the company said on X. Chief Technology Officer Olaoluwa Osuntokun identified the vulnerability as CVE-2026-111943 and recommended installing the releases or rebuilding the software with Go 1.27.3.

The warning reaches software used to operate Lightning payment channels: lnd manages channels and routes payments, and can use btcd as its Bitcoin full-node backend.

The affected component is Go’s `crypto/x509` certificate verifier. Go’s advisory says the language normally uses system root certificates, but some trust stores may remain outdated without further action. The fix rejects certificate chains containing the distrusted intermediate keys.

For operators, the risk is server impersonation on TLS-secured connections. An attacker able to intercept or redirect a connection could read or modify traffic if the client still trusts an affected key and no other protection blocks the attack, according to Cisco Talos.

Talos said it had seen no malicious incidents involving the compromised certificates as of 10 a.m. ET on Oct. 21. eMudhra said the weak keys arose during a key-generation procedure, its infrastructure had not been compromised, and the affected intermediates had issued no certificates.

Which Releases Contain the Fix

Osuntokun directed users to these releases, whose pages confirm they were built with Go 1.27.3:

- **lnd:** v0.21.5-beta.rc1, marked as a pre-release. - **Taproot Assets:** v0.8.7, rebuilding both `tapd` and `tapcli`. - **btcd:** v0.27.0. - **Lightning Terminal:** v0.17.8, rebuilding Terminal and its bundled daemons.

Go’s vulnerability database lists affected toolchains as versions before 1.26.10 and the 1.27 series before 1.27.3. For these applications, the security change depends on the Go version used to compile the executable: the Taproot Assets release notes explicitly warn that updating Go on a host does not patch an existing binary. Operators must replace the binary or rebuild it with the patched toolchain.

Lightning Terminal illustrates that distinction: its bundled Taproot Assets source remains at v0.8.6, but all bundled services are compiled with Go 1.27.3.

The Taproot Assets and Terminal notes advise backing up databases before upgrading and arranging a controlled update for nodes using Taproot Assets channels.