CLN users: older versions of the webpki-roots dependency (RUSTSEC-2026-0381) still trust compromised emSign intermediate certificates, which may expose HTTPS requests to potential MITM attacks. Core CLN code and the Lightning protocol are unaffected. The vulnerability is limited to the currencyrate (cln-currencyrate) plugin, which is enabled by default. Exposure is possible when: - Using commands provided by the currencyrate plugin - Configuring bkpr-currency for the bookkeeper plugin The BIP353 plugin is unaffected in practice. Its upstream dependency includes an LNURL fallback path that uses HTTPS, but CLN's BIP353 plugin relies on DNS resolution and ignores the LNURL fallback result, so the affected TLS certificate validation path is not used. If you don't need currencyrate, disable it by adding this to your CLN configuration: disable-plugin=cln-currencyrate A fix is pending the relevant upstream dependency updates and a subsequent CLN release. Nodes not using the affected currencyrate functionality are not expected to be exposed, even with the plugin enabled.