Core Lightning has released version 26.06.9, addressing multiple security vulnerabilities and a payment-processing bug affecting Bitcoin’s Lightning Network infrastructure. The update also resolves a regression introduced in version 26.06.8 that could delay channel-related messages and interfere with normal network operations.
One of the key fixes addresses a condition in which a payment involving a Hash Time Locked Contract (HTLC) could remain unresolved beyond its intended deadline during channel shutdown. The updated implementation ensures that the affected channel is force-closed when necessary, reducing the risk of prolonged or improper handling of the payment.
The release also strengthens authorization controls for runes, Core Lightning’s mechanism for restricting API access. The changes tighten permission checks involving the invokerune and destroyrune aliases, helping prevent unauthorized actions. Additional safeguards address the handling of sensitive configuration values, which are now masked in listconfigs output. The update also closes a configuration-injection vulnerability associated with setconfig.
Some security tests have been temporarily withheld as part of the release process. Core Lightning also notes that users running the development master branch cannot downgrade directly to the 26.06.x release series because of database schema incompatibility. Operators should account for this limitation before changing versions.
The release includes further operational considerations for Lightning Network participants. Dual funding remains experimental, and the project continues to discourage the use of zero-confirmation channels with untrusted peers because of the associated security risks.
The release highlights the importance of maintaining current Lightning Network infrastructure as payment reliability, channel management and API authorization remain critical to the security of Bitcoin’s off-chain payment ecosystem. Node operators should review the release notes and assess their deployment before upgrading, particularly if they run development builds or rely on experimental channel features.
