Core Lightning Issues Urgent Update for Bitcoin Nodes to Fix Critical Vulnerabilities

Core Lightning Version 26.06.10 Update

The developers behind Core Lightning, a critical software for managing Bitcoin Lightning payment nodes, are urging users to promptly upgrade to version 26.06.10. This latest iteration addresses significant vulnerabilities relating to channel security, payment resolutions, and remote access.

Security Recommendations

Along with the software update, maintainers are advising users to double-check the credentials for remote operations, as tightening access permissions is an essential security measure to accompany the upgrade.

This crucial release carries a strong recommendation to install it as soon as feasible.

To mitigate the risk of newly discovered security holes becoming targets for exploitation, maintainers have chosen to pause security-fix testing. The revision also enhances transaction signature verification during the opening of Bitcoin dual-funded channels and splicing, aligning with the Lightning protocol's BOLT 2 framework.

Addressing Previous Issues

Previously, there was an issue where a recently eliminated HTLC (Hashed Time-Locked Contract) could be mistaken for an active contract if both shared the same payment hash, amount, and expiry conditions. This could lead to a scenario where the node improperly failed an existing payment, even when the peer still held a claim on it.

Additionally, the update imposes stricter regulations by disallowing channel openings when a peer sets a dust limit exceeding 5,000 satoshis. This was previously exploited, allowing a peer to incur fees at the expense of the node during a forced closure. Moreover, dual-funded channels will also deny a peer's dust limits if they surpass the channel reserve threshold.

Experimental Features and Restrictions

As dual funding technology remains in an experimental phase, developers discourage the establishment of zero-confirmation channels with untrusted participants. The release further restricts v2 zero-confirmation channel openings unless the operator has explicitly allowed that specific peer.

Notably, nodes that had their master versions running cannot revert to the earlier 26.06.x series due to incompatibilities with the updated database schema. The version 26.06.10 became available on GitHub on November 4, though the changelog erroneously tags it as November 5. This release follows the security enhancements seen in version 26.06.9 and addresses an earlier issue that surfaced with a stored-trigger crash reported on November 2.

Security Enhancements

Core Lightning's commando interface enables a directly connected peer to instruct the node to execute specific commands. Generally, such requests require a rune, a type of authorization credential. This update has fortified security by closing loopholes that allowed bypassing rune restrictions through parameter names that were duplicates or variations brought by punctuation.

Furthermore, issues leading to a crash when reusing command IDs after failed transactions have been rectified, and the software now rejects oversized runes, which previously burdened the system with excessive decoding tasks.

Maintainers also recommend binding runes to the node's ID to tighten security and suggest using a blacklist for any runes that cannot be accounted for, allowing operators to implement replacements with restricted access criteria.