Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds.
We urge all Core Lightning users running experimental features to disable them immediately while we investigate.
Core Lightning 26.06.7 is out and recommended for every node runner.
It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.
Like many open source Bitcoin projects, CLN has received a number of AI-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed.
We’re now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We’re aiming to have an initial version of the point release available within the next few days.
CLN 26.06rc1 is live. Graceful shutdowns, more control over payment amounts, and a smarter payment engine under the hood.
Please upgrade and send us your feedback or open an issue on GitHub. This is open source Lightning in action. ⚡