Core Lightning Docker images shipped without security fixes despite showing v26.06.7

Four Docker tags missed security patches

Core Lightning maintainers discovered that four Docker image tags reported version v26.06.7 at startup but actually contained binaries without the security fixes introduced in that release. The affected tags are v26.06.7, latest, v26.06.7‑vls and latest‑vls.

Key points

• Images without the fixes were served from 28 Aug 2026 16:04 UTC until 1 Sep 2026.
• Startup output shows the correct version, so operators cannot rely on it to confirm the patch.
• Maintainers have replaced the faulty images and removed references to the incorrect manifests.
• A 14‑day embargo on publishing the source code is in place, with a planned disclosure on 11 Sep 2026.

How operators can verify

Operators who previously pulled any of the four tags should compare the image’s digest (a unique hash) with the corrected values. The correct digests are:

To inspect a local image, run:

docker image inspect --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7

If the digest differs from the table, pull the corrected image with:

docker pull elementsproject/lightningd:v26.06.7

VLS users must use the separate VLS digest and ensure the VLS_CLN_VERSION setting matches v26.06.7.

Why the issue matters

The bug could leave Lightning nodes vulnerable to attacks that the missing security fixes were designed to block. Because the version string appears correct, operators might mistakenly believe they are protected.

Next steps

Operators should verify their Docker image digests immediately and re‑pull any mismatched images before the source code is released on 11 Sep 2026. The maintainers warn that GitHub’s automatically attached source archives are not the correct v26.06.7 source, so building those archives will not include the patches.

Sources

• CryptoSlate