Core Lightning patches critical security flaws and a Bitcoin payment bug

Core Lightning Patches Critical Security Flaws and Bitcoin Payment Bug

Introduction

Core Lightning, software for running Bitcoin Lightning payment nodes, has released version 26.06.9 with security fixes and a repair for a Bitcoin payment bug. The update addresses a regression that could throttle peers and delay channel traffic on nodes running version 26.06.8.

Security Fixes and Bug Repairs

The new release includes fixes for a payment contract that reaches its deadline while a channel is shutting down. It now force-closes the channel in that situation, preventing forwarded funds from being lost if the payment is fulfilled late. The update also includes fixes for a message-budget regression and adds shutdown, permission, and configuration safeguards.

Configuration and Security Enhancements

The listconfigs command now masks several sensitive values, including recovery information and Bitcoin RPC passwords, for every caller. The setconfig command closes a path for injecting configuration lines through persistent option values. The update also enforces the limits carried by runes used to authorize calls, so a restricted rune can no longer create an unrestricted one or relist blacklisted runes.

Recommendations and Warnings

Maintainers urge Core Lightning users, including those on version 26.06.8, to upgrade to version 26.06.9 as soon as practical. Nodes that have run master cannot downgrade to a 26.06.x release because their database schema is newer. The release also reiterates that dual funding remains experimental and discourages zero-confirmation channels with untrusted peers.