Core Lightning vulnerability puts funds at risk on nodes using experimental features

  • Core Lightning urged operators to disable experimental features immediately while investigating a newly discovered issue.
  • Core Lightning released version 26.06.7 on August 28 to address earlier August issues.
  • Lightning Development Kit reported no observed losses or exploited applications during its August security emergency.

Core Lightning warned on September 15 that operators running experimental features should disable them immediately while developers investigate an issue that could put funds at risk. The advisory does not affect Bitcoin’s main network. The flagged options are --experimental-dual-fund, --experimental-splicing and --experimental-peer-storage. SlowMist said a similar issue fixed in August allowed a remote peer to set arbitrary or zero fees during channel opening or fund adjustment, with local nodes able to sign and store the data without additional verification. That could result in abnormal fee payments or crash loops that leave nodes offline. The warning followed a separate August security episode involving a high volume of AI-generated CVE reports. Core Lightning advised operators on August 28 to upgrade to version 26.06.7, while technical details were published on GitHub on September 11 after a two-week embargo. The Lightning Development Kit, another Lightning Network implementation, also faced a security emergency in August but reported no observed losses or exploited applications.

The information on this website is generated using AI and we cannot guarantee its accuracy. Please use it as reference information only.