Maintainers of the Bitcoin Lightning software have reported that four Core Lightning Docker tags delivered unpatched binaries while incorrectly displaying version v26.06.7 at startup. The packaging error leaves certain node operators exposed despite believing they had successfully upgraded.
According to the updated release notice, the affected tags include v26.06.7, latest, v26.06.7-vls, and latest-vls. These tags served images lacking the release's security fixes between Aug. 28 at 16:04 UTC and Sept. 1. An automated build process mistakenly published the images from a placeholder tag before maintainers replaced them and removed references to the incorrect manifests.
Because startup output cannot confirm whether an existing container received the patched binary, operators who retained a faulty image must verify their image digests. Users pinned to v26.06.6 or earlier are exempt from this packaging issue.
Verifying Image Digests
Maintainers have instructed anyone who previously pulled one of the four affected tags to compare its identifying hash against corrected values:
- v26.06.7, latest: sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4
- v26.06.7-vls, latest-vls: sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f
Operators of standard versioned images can inspect their local image using the following command:
docker image inspect --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7
If the digest differs, operators are advised to pull the corrected image using docker pull elementsproject/lightningd:v26.06.7 or the corresponding command for the latest tag. Validating VLS users must ensure their VLS_CLN_VERSION setting matches v26.06.7, while the signer itself remains VLS v0.14.0.
Source Disclosure Timeline
The Aug. 28 release established a 14-day embargo on publishing its source code, with a planned disclosure date of Sept. 11. Maintainers implemented the delay to give node operators time to upgrade before potential attackers can reverse-engineer the fixes. During this embargo period, maintainers warned that GitHub's automatically attached source-code archives do not contain the v26.06.7 source and will not produce the advertised patched binaries if built.
