Core Lightning: currencyrate plugin trusts compromised certificates, enabling possible HTTPS MITM (RUSTSEC-2026-0381)
The Core Lightning project reports on its channel that older versions of the webpki-roots dependency continue to trust compromised emSign intermediate certificates, which may expose HTTPS requests to MITM attacks. CLN's own code and the Lightning protocol are not affected: the issue is limited to the currencyrate plugin, which is enabled by default. The risk arises when using this plugin's commands and when configuring currency conversion for the bookkeeper plugin. The BIP353 plugin is not affected in practice because it relies on DNS and ignores the vulnerable certificate verification path.
If you do not need currencyrate functionality, disable the plugin now by adding disable-plugin=cln-currencyrate to the CLN configuration. A fix has not yet been released: it is waiting for a dependency update and the next CLN release, so until then rely on disabling the plugin rather than updating.
Source: x.com - Core_LN