Core Lightning Urges Upgrade to 26.06.10 to Patch Channel Flaws

Core Lightning released version 26.06.10 on Nov. 4, urging all node operators to verify the release signatures and install security fixes addressing risks to channel balances and remotely triggered crashes.

The project's changelog describes a flaw that let a channel peer set an excessive threshold for small outputs, allowing the operator's balance to be consumed as transaction fees when the channel was force-closed. Another fix addresses a settlement error in which a node could wrongly report a forwarded payment as failed while its peer could still claim it onchain.

Core Lightning is software for running a Bitcoin Lightning Network node, opening payment channels and sending and receiving payments. Other fixes address peer-triggered crashes, channel-funding stalls and a DNS lookup bug that could freeze all peer traffic.

“Verify the signatures and install it as soon as possible,” Core Lightning said in its announcement. Blockstream echoed the call, urging operators to upgrade “today.”

Maintainers said the release and its fixes are available without an embargo. They have temporarily withheld tests for the security fixes to make it harder to turn the patches into working exploits and give operators more time to upgrade before further technical details are published.

The upgrade call also applies to operators who installed October's 26.06.9 security release, which patched channel and payment-handling vulnerabilities: the latest recommendation is for all users. The new release notes do not specify the first affected version for each flaw or report observed exploitation or losses.

The release instructions tell operators to check the signatures against the file manifest first, then verify the download checksums. Separate signed manifests are provided for ARM builds.