Core Lightning Urges v26.06.10 Upgrade to Fix Unpatched Software Flaws

Maintainers of Core Lightning, a software package used for running Bitcoin Lightning payment nodes, have strongly recommended that users install version 26.06.10 as soon as possible. The fresh update arrives to address several pressing security vulnerabilities concerning channel-security mechanisms, payment-resolution processes, and remote-access interfaces. To slow the conversion of these patches into working exploits and grant node operators additional time to upgrade, maintainers temporarily withheld specific security-fix tests.

The updated software introduces vital checks on peer transaction signatures during the opening of Bitcoin dual-funded channels and splicing operations, following the guidelines of the BOLT 2 specification. A previous issue involved conditional Bitcoin payment contracts known as HTLCs. Specifically, an HTLC that had just been removed could mistakenly be confused with an active one sharing an identical payment hash, amount, and expiry time. This flaw could cause a node to incorrectly fail a live payment upstream even though its peer retained the ability to claim it.

Another important fix rejects channel open requests whenever a peer proposes a dust limit exceeding 5,000 satoshis. Previous behavior allowed peers to reduce a node's balance into fees during forced channel closes. Dual-funded openings now also reject any peer dust limit that surpasses the established channel reserve. Furthermore, maintainers continue to classify dual funding as experimental and advise against utilizing zero-confirmation channels alongside untrusted peers. Version 26.06.10 refuses v2 zero-confirmation opens unless the operator has specifically configured acceptance for that particular peer.

Install v26.06.10 promptly to address critical channel-security and remote-access vulnerabilities.

Reviewing Remote Commands and Unpatched Credentials

Alongside the software upgrade, maintainers stressed that operators must review and restrict credentials used for remote commands. The Core Lightning commando interface enables connected peers to request command execution using authorization credentials known as runes. The recent update closes a vulnerability that allowed users to bypass rune parameter restrictions by employing duplicate or punctuation-variant names. It also resolves a commando crash triggered by reusing command IDs after failed executions and rejects oversized runes that previously consumed excessive decoding resources.

Operators are advised to bind commando runes directly to the target node ID using an identifier restriction. Maintainers also recommend blacklisting any unaccounted-for runes using the blacklistrune command and issuing secure replacements with stricter access limitations. Nodes running the master branch cannot downgrade to the 26.06.x series due to a newer database schema.

Why it matters

This security release alters how payment nodes handle peer interactions, dual-funded channels, and remote command authorizations. By addressing channel-security flaws and credential management, the update helps protect node operators against unexpected balance deductions and unauthorized access attempts.