Core Lightning patches flaw that could let revoked channel state escape penalty

Core Lightning, a Lightning Network node implementation, fixed a channel-close flaw in v26.06.7 that could let a peer broadcast an old, revoked channel state without triggering the penalty for cheating. Bitcoin Optech's Sept. 25 explanation of the now-public patch makes the risk concrete for operators still running older builds.

That depended on a specific channel setup. A peer that had not specified an upfront shutdown script when the channel opened could later name the output script of its revoked commitment in a shutdown message. It could then abandon the cooperative close and broadcast the old commitment. Matching the outputs alone made the transaction look legitimate, bypassing the penalty path, according to the maintainers' patch notes and regression test.

The repair checks a transaction's locktime and sequence encoding to recognize a commitment before looking at its outputs as a possible mutual close. The materials describe a potential way to evade the penalty, not a confirmed theft. This is a Core Lightning channel-handling issue, not a change to Bitcoin's base-chain rules.

A Core Lightning build older than the fixed v26.06.7 release needs an update. The project strongly recommends v26.06.8, a later security release with additional fixes. The revoked-close path requires the shutdown-script condition above, so a vulnerable software version does not mean every channel could be exploited that way.

Operators who used Docker images during the earlier rollout should also verify the image digest. The project's v26.06.7 release notes say that images served under v26.06.7 and related tags from Aug. 28 to Sept. 1 reported the new version on startup but lacked its fixes. The project lists the corrected digests and instructs users with a mismatch to re-pull the image.