TLDR
- Core Lightning released v26.06.10 with security fixes and urges all users to upgrade quickly.
- Operators are told to review and rotate runes, the credentials that allow remote commands.
- Maintainers again withheld security-fix tests to slow the creation of working exploits.
- Channel opens with peer dust limits above 5,000 satoshis are now refused.
- Nearly 20 named sources reported the flaws fixed in this release.
Core Lightning, software used to run Bitcoin Lightning payment nodes, has released version 26.06.10 with a new set of security fixes. Maintainers are asking all users to upgrade as soon as practical.
The release also gives operators a second job. They are told to review the credentials that allow remote commands on their nodes, separate from the software update itself.
This is the third point release in a row shipped with no embargo period. Versions 26.06.8 and 26.06.9 followed the same approach, with fixes made public right away.
Maintainers have again held back the tests tied to the security fixes. The release notes say this makes it harder to turn the fixes into working exploits and gives users more time to upgrade.
Credential Review Added to the Upgrade Checklist
Several fixes target runes and commando. Commando lets a directly connected peer ask a node to run a command, and the peer generally needs a rune, an authorization credential, to do so.
The update closes a way to get around rune limits on parameter names by using duplicate or punctuation-variant names. It also fixes a commando crash caused by reusing a command ID after a failed command.
Oversized runes are now rejected outright. Before, the software could spend quadratic time decoding them.
Maintainers recommend binding each rune used over commando to the node ID of the app that uses it. This id restriction means the rune cannot be used from anywhere else.
Operators are also told to blacklist any runes they cannot account for using the blacklistrune command. They should then issue new runes with tighter restrictions.
Channel and Payment Fixes
The new version checks a peer’s transaction signatures during dual-funded channel opening and splicing. This follows the Lightning protocol’s BOLT 2 specification, according to the changelog.
Another fix deals with a conditional payment contract known as an HTLC. A just-removed HTLC could be confused with a live one sharing its payment hash, amount and expiry, causing the node to fail the live payment while its peer could still claim it.
Nodes now refuse channel opens when a peer proposes a dust limit above 5,000 satoshis. The changelog says the old behavior let a peer trim the node’s balance into fees during a forced close.
For dual-funded opens, a peer’s dust limit above the channel reserve is also refused. A v2 zero-confirmation open is refused unless the operator has set the node to accept one from that peer.
Dual funding remains experimental. Maintainers discourage zero-confirmation channels with peers that are not trusted.
Other changes give a safe default reply when a plugin hook fails, instead of a crash or hang. Splice fee bumps now use at least 25/24 of the prior feerate, which peers such as Eclair require.
Nodes that have run development builds cannot downgrade to the 26.06.x series because their database schema is newer. The release ships reproducible binaries for Ubuntu 22.04, 24.04 and 26.04, plus Docker images.
The fixes were reported by nearly 20 named sources, including The Bitcoin Red Team, Matt Morehouse and Niklas Gögge. Others asked not to be named.
GitHub lists a Nov. 4 release date for the version, while its tagged changelog shows Nov. 5. The update follows a separate stored-trigger crash on Nov. 2, and Bitcoin traded near $76,002 at the time of reporting, down 5.29% over 24 hours.
