Core Lightning 26.06.7

Original release notes

This point release includes fixes for vulnerabilities responsibly reported by a number of sources. It also comes at a time when increasingly capable AI models are being used to identify potential vulnerabilities in open-source code, significantly increasing the volume and pace of security reports.

The potential impact and associated risks are front of mind for everyone involved, not least the remediation team who have worked tirelessly to triage, resolve, and compile this release.

This embargo period will last for two weeks. The source code will not be published until 14 days have passed. During this time, we strongly encourage everyone to upgrade. At the end of this two-week period, the full release details will be made available.

This delay is designed to reduce the chances of prospective attackers reverse-engineering the fixes and exploiting them before the network can update.

Upgrading

Download the tarball for your platform below, verify it (see next section), then unpack it over your existing installation:

sudo tar -xvf <release>.tar.xz -C /usr/local --strip-components=2

Restart lightningd afterwards. No database migration steps are required beyond the automatic ones applied at startup.

Docker users

Docker images for this release are published and correct.

| Tag | Digest | | --- | --- | | v26.06.7, latest | sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4 | | v26.06.7-vls, latest-vls | sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f |

Platforms: linux/amd64, linux/arm64, linux/arm/v7.

If you pulled v26.06.7, latest, v26.06.7-vls or latest-vls before reading this, check the digest and re-pull if it does not match the table above.

Between 28 August 16:04 UTC and 1 September, those tags served images that reported v26.06.7 on startup but did not contain the fixes in this release. They were published automatically by CI from a placeholder tag. They have been replaced, and the incorrect manifests are no longer referenced by any tag.

Check what you are running:

docker image inspect --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7

If the digest does not match the table above, re-pull:

docker pull elementsproject/lightningd:v26.06.7
docker pull elementsproject/lightningd:latest

Users pinned to v26.06.6 or earlier were never affected.

VLS users

v26.06.7-vls carries the same signer as v26.06.6-vls, VLS v0.14.0, unchanged by this release.

The signer requires VLS_CLN_VERSION to match the node it talks to. Update it from v26.06.6 to v26.06.7 when you upgrade, or remote_hsmd_socket will refuse to start.

Notes on these images

They are assembled from the signed release tarballs above rather than compiled from source, so the binaries in the container are the ones covered by the signed manifests.
linux/arm/v7 has no release tarball. Its binaries are cross-compiled separately and are not covered by a signed manifest.
The images carry no provenance or SBOM attestations.
CLN now installs to /usr/bin and /usr/libexec/c-lightning; previous images used /usr/local. Symlinks from the old locations are included, so hardcoded paths keep working.

Verifying your download

Every binary is covered by a signed manifest. Check the checksums first:

sha256sum -c SHA256SUMS-v26.06.7 --ignore-missing

Then the signatures:

gpg --verify SHA256SUMS-v26.06.7.asc SHA256SUMS-v26.06.7

SHA256SUMS-v26.06.7 covers the amd64 tarballs and is signed by maintainers. SHA256SUMS-v26.06.7-arm64 covers the arm64 tarballs and has its own signature file. Signing keys:

| Signer | Fingerprint | | --- | --- | | nGoline | 4E4A 142F 8BD3 C38A 56B3 62ED 578C AC08 4725 45C5 | | Christian Decker | B731 AAC5 21B0 1385 9313 F674 A26D 6D9F E088 ED58 | | Peter Neuroth | 653B 19F3 3DF7 EFF3 E9D1 C94C C3F2 1EE3 87FF 4CD2 | | daywalker90 | 8A07 9421 A871 D0B1 0835 1193 7AB4 802E D5A6 39F3 |

Fetch them with gpg --recv-keys <fingerprint>, or from the contrib/keys/ directory of the repository once the source is published.

Reports Received from (No Particular Order)

The Most Thoughtful Remediation Team

---

Notes

The "Source code (zip)" and "Source code (tar.gz)" links that GitHub attaches to this release are not the v26.06.7 source. They are generated automatically and cannot be removed. The v26.06.7 source will be published when the embargo ends, 14 days from this release. Do not build from those archives expecting to get these binaries.

A commitment to the source has been published in advance. SHA256SUMS-v26.06.7 includes an entry for clightning-v26.06.7.zip, the source archive, even though that file is not attached to this release. Because the manifest is signed and published today, anyone can confirm when the source appears that it is the same source these binaries were built from, and that nothing was altered during the embargo.

Reproducing the binaries. Full build instructions will accompany the source release. This release was not built with the default optimisation settings, so a standard build will not reproduce these checksums; the exact parameters will be published alongside the source.