Core Lightning, the software used to operate Bitcoin Lightning payment nodes, is urging users to install v26.06.10 to address channel-security, payment-resolution and remote-access flaws, according to the project's release notice.
Maintainers recommend upgrading as soon as practical. They have temporarily withheld tests for the security fixes to slow the conversion of patches into working exploits and give operators more time to upgrade.
Channel and payment fixes
The new version adds checks on a peer's transaction signatures during Bitcoin dual-funded channel opening and splicing, in line with the Lightning protocol's BOLT 2 specification, according to the tagged changelog.
One fix addresses a conditional Bitcoin payment contract, known as an HTLC, that had just been removed being confused with a live one sharing its payment hash, amount and expiry. In that scenario, the node could fail the live payment upstream even though its peer could still claim it.
Another fix rejects channel opens when a peer proposes a dust limit above 5,000 satoshis. The changelog says the previous behavior let a peer trim the node's balance into fees during a forced close. Dual-funded opens also reject a peer's dust limit when it exceeds the channel reserve.
Dual funding remains experimental, and maintainers discourage zero-confirmation channels with untrusted peers. The release refuses a v2 zero-confirmation open unless the operator has configured acceptance for that peer.
Nodes that have run master cannot downgrade into the 26.06.x series because their database schema is newer.
Remote-command credentials
Core Lightning's commando interface lets a directly connected peer request that a node execute a command. The peer generally needs a rune, an authorization credential permitting the command.
The update closes a way to bypass rune restrictions on parameter names using duplicate or punctuation-variant names. It also fixes a commando crash triggered by reusing a command ID after a failed command, and rejects oversized runes that previously consumed excessive decoding work.
Maintainers recommend binding runes used over commando to the authorized application's node ID, blacklisting runes operators cannot account for with blacklistrune, and replacing them with more tightly restricted credentials.
GitHub displays a Nov. 4 release date for v26.06.10, while its tagged changelog dates the same version Nov. 5. The release follows the v26.06.9 security fixes and a separate stored-trigger crash reported on Nov. 2.
