Core Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo

Core Lightning has issued patch release v26.06.7, fixing several vulnerabilities reported by independent researchers. The release's source code is deliberately withheld — a 14-day embargo is intended to make reverse-engineering the fixes harder before the network updates. The maintainers explicitly ask users to update now, without waiting for Docker images.

Actions to take

Update your Core Lightning node to v26.06.7 now: download and verify the signed tarballs linked below without waiting for Docker images, and restart lightningd.

Source: github.com

Incident history

26 AugStart9 demands urgent Core Lightning update on StartOS
26 AugBTCPay Server disables routes through CLN and Eclair by default
27 AugSecurity update for the Core Lightning application on Umbrel
27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project