The Bitcoin Lightning software’s maintainers report that four Docker image tags inadvertently deployed unpatched binaries while claiming to run version v26.06.7 at startup, leaving affected operators vulnerable until the issue was identified and remedied.
Some Core Lightning node operators who upgraded through Docker using the compromised version v26.06.7 may still lack essential security patches. The affected tags—v26.06.7, v26.06.7-vls, and latest-vls—served malformed images between August 28 at 16:04 UTC and September 1. No precise termination time has been established for when these problematic builds stopped being distributed.
An automated build process had published containers derived from a placeholder tag. Maintainers have since replaced the broken images and removed any references to the incorrect manifests. However, operators retaining the outdated bundle cannot assume their current runtime reflects the fix simply by checking the default version string.
The August 28 release imposed a fourteen-day embargo on publishing the source code, directing observers to a forthcoming announcement. By September 8, the notice still characterized publication as yet pending, though maintainers emphasized that this delay provides operators additional breathing room to upgrade safely before potential adversaries could analyze the remediation.
A secondary pitfall arises from the embargo period. When source repositories are automatically attached as build artifacts, they do not correspond to the corrected v26.06.7 code. Builders of these archives risk producing binaries that omit the promised safety updates.
How to Check the Docker Image to Fix the Lightning Bug
Maintainers urge anyone who previously pulled one of the problematic tags to compare its image digest—the cryptographic hash identifier versus the official corrected value. This verification step determines whether a host is truly operating the secured version.
To inspect the local image, users can execute:
docker image inspect —format ‘{{index .RepoDigests 0}}’ elementsproject/lightningd:v26.06.7
If the displayed digest bears no relation to the known correct signature for that tag, the corresponding download command applies:
docker pull elementsproject/lightningd:v26.06.7
For operators utilizing the VLS variant, different parameters dominate. The VLS-specific digest appears within the accompanying documentation, and alignment of several configuration settings must be verified—particularly VLS_CLN_VERSION must equal “v26.06.7”, while the signer remains VLS v0.14.0 otherwise remote_hsmd_socket will reject session initialization.
Previously pinned snapshots at v26.06.6 or lower benefited from the mistaken packaging scheme, meaning the most recent vulnerability did not affect those earlier releases. Consequently, only nodes currently holding v26.06.7—or newer—and unaware of the revised manifest are subject to exposure.
The image correction necessitates rigorous validation after attempting an upgrade, especially considering the extended embargo phase when unauthenticated sources differ markedly from the approved fix.
How to Verify & Re-Heal Affected Nodes
Operators experiencing lingering issues should cross‑check their container’s state against the authoritative repository output above. If discrepancies persist, pulling the tagged image ensures the protected binary loads correctly.
The August 28 release set a 14‑day embargo on publishing its source, pointing to a planned September 11 disclosure. As of September 8, the notice still describes that publication as upcoming. Maintainers highlight that this timing allows nodes to finalize upgrades before security researchers might attempt reverse‑engineering the remediated code.
