Core Lightning · Core Lightning (CLN)
Update to incident: Start9 demands urgent Core Lightning update on StartOS
Core Lightning 26.06.7 Docker image rebuilt with the full fix
The vendor reports that the 26.06.7 Docker image has been updated and now actually contains the security fix that was previously missing from it. Operators deployed through Docker are affected.
Actions to take
If your Core Lightning node is deployed through Docker, pull the updated 26.06.7 tag right now.
Sources:
Incident history
- 26 AugStart9 demands urgent Core Lightning update on StartOS
- 26 AugBTCPay Server disables routes through CLN and Eclair by default
- 27 AugSecurity update for the Core Lightning application on Umbrel
- 27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
- 28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
- 28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
- 29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
- 01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
- 02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
- 08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project