Core Lightning, the software implementation for operating Bitcoin Lightning Network nodes, has released version 26.06.10 to resolve critical vulnerabilities affecting channel security, payment resolution, and remote command access. Maintainers are urging operators to upgrade immediately and to audit existing remote-access credentials as a separate, essential step.
The release notice advises upgrading as soon as practical. To provide operators with a wider window to apply patches before exploit code can be developed, maintainers have temporarily withheld security-fix tests from the public repository.
According to the tagged changelog, the new version enforces stricter verification of a peer’s transaction signatures during dual-funded channel opening and splicing operations, aligning with the Lightning protocol’s BOLT 2 specification. A logic error involving Hash Time-Locked Contracts (HTLCs) has also been corrected: previously, a recently removed HTLC could be mistaken for a live one sharing the same payment hash, amount, and expiry, causing the node to fail the valid payment upstream while the peer could still claim the funds.
Additionally, the update rejects channel opening proposals where a peer sets a dust limit exceeding 5,000 satoshis. The changelog notes that the prior behavior allowed a malicious peer to erode the node’s balance into fees during a forced closure. For dual-funded channels, the software now also rejects a peer’s dust limit if it surpasses the channel reserve requirement.
Dual funding remains classified as experimental. Maintainers continue to discourage the use of zero-confirmation channels with untrusted peers. The release further enforces that version 2 zero-confirmation channel opens are refused unless the operator has explicitly configured acceptance for that specific peer.
Operators should note that nodes which have run the master branch cannot downgrade to the 26.06.x series due to an incompatible, newer database schema.
GitHub lists a November 4 release date for v26.06.10, while the tagged changelog records November 5. This patch follows the v26.06.9 security fixes and a separate stored-trigger crash fix issued on November 2.
Core Lightning: Patch the Node, Review Remote Access
Version 26.06.10 introduces critical software checks. Beyond the binary upgrade, maintainers strongly advise operators to bind and review all issued commando credentials.
Administrators should install v26.06.10 and immediately audit commando runes: bind them to the intended node ID and replace any credentials that cannot be fully accounted for.
The following schematic illustrates selected fixes and maintainer recommendations. It does not imply that all credentials are properly restricted or that exploitation has occurred.
Method: Diagram of two documented software surfaces with selectable channel-check and remote-command details. Arrows represent requests and maintenance steps, not Bitcoin transfers, measured traffic, or live access tests.
Review Remote-Command Credentials
Core Lightning’s commando interface allows a directly connected peer to request command execution on a node, typically requiring a rune—an authorization credential permitting specific actions.
The update closes a bypass that allowed circumvention of rune restrictions on parameter names using duplicates or punctuation variants. It also resolves a commando crash caused by reusing a command ID after a previous failure and mitigates a denial-of-service vector by rejecting oversized runes that previously consumed excessive decoding resources.
Maintainers recommend binding runes used via commando to the application’s node ID through an id restriction. They further advise operators to blacklist unaccounted runes using blacklistrune and issue replacement credentials with tighter constraints.