v26.06.7 Quantum-Resistant Lightning Channel VII

This point release includes fixes for vulnerabilities responsibly reported by a number of sources. It also comes at a time when increasingly capable AI models are being used to identify potential vulnerabilities in open-source code, significantly increasing the volume and pace of security reports.

The potential impact and associated risks are front of mind for everyone involved, not least the remediation team who have worked tirelessly to triage, resolve, and compile this release.

This embargo period will last for two weeks. The source code will not be published until 14 days have passed. During this time, we strongly encourage everyone to upgrade. At the end of this two-week period, the full release details will be made available.

This delay is designed to reduce the chances of prospective attackers reverse-engineering the fixes and exploiting them before the network can update.

Upgrading

Download the tarball for your platform below, verify it (see next section), then unpack it over your existing installation:

sudo tar -xvf <release>.tar.xz -C /usr/local --strip-components=2

Restart lightningd afterwards. No database migration steps are required beyond the automatic ones applied at startup.

Docker users

Docker images for this release are published and correct.

Tag	Digest
v26.06.7, latest	sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4
v26.06.7-vls, latest-vls	sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f

Platforms: linux/amd64, linux/arm64, linux/arm/v7.

If you pulled v26.06.7, latest, v26.06.7-vls or latest-vls before reading this, check the digest and re-pull if it does not match the table above.

Between 28 August 16:04 UTC and 1 September, those tags served images that reported v26.06.7 on startup but did not contain the fixes in this release. They were published automatically by CI from a placeholder tag. They have been replaced, and the incorrect manifests are no longer referenced by any tag.

Check what you are running:

docker image inspect --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7

If the digest does not match the table above, re-pull:

docker pull elementsproject/lightningd:v26.06.7
docker pull elementsproject/lightningd:latest

Users pinned to v26.06.6 or earlier were never affected.

VLS users

v26.06.7-vls carries the same signer as v26.06.6-vls, VLS v0.14.0, unchanged by this release.

The signer requires VLS_CLN_VERSION to match the node it talks to. Update it from v26.06.6 to v26.06.7 when you upgrade, or remote_hsmd_socket will refuse to start.

Notes on these images

• They are assembled from the signed release tarballs above rather than compiled from source, so the binaries in the container are the ones covered by the signed manifests.
• linux/arm/v7 has no release tarball. Its binaries are cross-compiled separately and are not covered by a signed manifest.
• The images carry no provenance or SBOM attestations.
• CLN now installs to /usr/bin and /usr/libexec/c-lightning; previous images used /usr/local. Symlinks from the old locations are included, so hardcoded paths keep working.

Verifying your download

Every binary is covered by a signed manifest. Check the checksums first:

sha256sum -c SHA256SUMS-v26.06.7 --ignore-missing

Then the signatures:

gpg --verify SHA256SUMS-v26.06.7.asc SHA256SUMS-v26.06.7

SHA256SUMS-v26.06.7 covers the amd64 tarballs and is signed by maintainers. SHA256SUMS-v26.06.7-arm64 covers the arm64 tarballs and has its own signature file. Signing keys:

Signer	Fingerprint
nGoline	4E4A 142F 8BD3 C38A 56B3 62ED 578C AC08 4725 45C5
Christian Decker	B731 AAC5 21B0 1385 9313 F674 A26D 6D9F E088 ED58
Peter Neuroth	653B 19F3 3DF7 EFF3 E9D1 C94C C3F2 1EE3 87FF 4CD2
daywalker90	8A07 9421 A871 D0B1 0835 1193 7AB4 802E D5A6 39F3

Fetch them with gpg --recv-keys <fingerprint>, or from the contrib/keys/ directory of the repository once the source is published.

Reports Received from (No Particular Order)

• erickcestari
• project-loupe
• instagibbs
• benthecarman
• 0xaudron@Kvazar_AI
• callebtc
• haoxucu
• vincenzopalazzo
• ksedgwic
• jaonoctus
• whkim0
• Ahmadsm2005
• labrat-guy
• FrancisPouliot
• Bitcoin Red team
• moinaiagent@coinos.io

The Most Thoughtful Remediation Team

• nGoline
• cdecker
• ddustin
• daywalker90
• Lagrang3
• sangbida
• rustyrussell
• nepet
• Andezion
• niftynei

---

Notes

The "Source code (zip)" and "Source code (tar.gz)" links that GitHub attaches to this release are not the v26.06.7 source. They are generated automatically and cannot be removed. The v26.06.7 source will be published when the embargo ends, 14 days from this release. Do not build from those archives expecting to get these binaries.

A commitment to the source has been published in advance. SHA256SUMS-v26.06.7 includes an entry for clightning-v26.06.7.zip, the source archive, even though that file is not attached to this release. Because the manifest is signed and published today, anyone can confirm when the source appears that it is the same source these binaries were built from, and that nothing was altered during the embargo.

Reproducing the binaries. Full build instructions will accompany the source release. This release was not built with the default optimisation settings, so a standard build will not reproduce these checksums; the exact parameters will be published alongside the source.

v26.06.6 Quantum-Resistant Lightning Channel VI

[26.06.6] - 2026-07-20: "Quantum-Resistant Lightning Channel VI"

v26.06.3, v26.06.4, and v26.06.5 had issues during publishing with the pypi releases and were deleted.

Fixed

• update pyln-proto's coincurve to a v21 fork to fix Python build environments (#9325)
• reject a channel that reuses an existing funding outpoint (#9318)

Contributors

Thanks to the Lightning team and our community contributors for their work on this release.

And, of course, to the core-Core Lightning team: @cdecker, @ShahanaFarooqui, @Lagrang3, @sangbida, @daywalker90, @nGoline, and @niftynei — carrying forward the work started by @rustyrussell, whose technical leadership and long-standing care for the project remain central to Core Lightning.

v26.06.2 Quantum-Resistant Lightning Channel II

This point release if recommended for all minimal OS setups, including docker images, that have no root certificates for TLS installed.

Fixed

• cln-currencyrate: include root certificates to fix the builder error on OS's without root certificates. (#9255)

Contributors

Thanks to the Lightning team and our community contributors for their work on this release.

Special thanks to @ddustin—still splicing, still appreciated! 🙌

And of course, to the core-Core Lightning team: @rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

v26.06.1 Quantum-Resistant Lightning Channel I

What's Changed

This point release fixes the bwatch plugin failure at registration.

Fixed

• Plugins: bwatch failed to register on startup after make install ([#9192])

Check out the updated Changelog

Contributors

Thanks to the Lightning team and our community contributors for their work on this release.

Special thanks to @ddustin—still splicing, still appreciated! 🙌

A shutout to the core-Core Lightning team: @rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

v26.06 Quantum-Resistant Lightning Channel

This release has been named by @enaples

Highlights for Users

• graceful command to prepare CLN for shutdown... gracefully!
• Added sendamount command, to make a payment specifying the desired amount to send instead of the amount to be received.
• We've started the cycle to deprecate pay and focus our efforts on xpay. xpay now handles pay command by default (use xpay-handle-pay=false to prevent this) and we now use xpay not pay for paying invoices made with invoicerequest().
• xpay now accepts label and localinvreqid parameters (like pay).
• xpay will now update for the current payment if it gets a channel_update in an error message.
• xkeysend command for keysend with modern routing support.
• invoice_creation notification now includes offer_id when the invoice is associated with a BOLT 12 offer.
• Removed fields no longer present in documentation / GRPC interfaces.
• Experimental payment proof implementation updated to latest draft
• gossipd made more robust against channel_update spamming.

Highlights for Developers

• JSON-RPC: createproof to create a payment proof for a (successful) BOLT12 payment.
• JSON-RPC: decode now supports the lnp payer proof format.
• Plugins: bwatch plugin (enable using plugin=bwatch)

Protocol Updates

• message-padding defaults to false, due to poor detection of broken implementations.
• We now wait 72 blocks, not 12, before closing channels (BOLT update)

See the changelog for full details

Since v26.04 we’ve had 236 commits in 42 days by 19 authors

A special mention to our three first time contributors:

@nGoline
@MSimeZ
@Andezion

A huge shout-out to @ddustin for his ongoing contributions and support. We truly appreciate your splicing—you really know how to keep things together! 🧬

An enormous thanks to the core-Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

v26.06rc2 Quantum-Resistant Lightning Channel

This release has been named by @enaples

Release Candidate 2 for cln v26.06

This RC builds upon RC1, with these changes:

• Removed fields no longer present in documentation / GRPC interfaces.
• Experimental payment proof implementation updated to latest draft
• gossipd made more robust against channel_update spamming.

See the changelog for full details

An enormous thanks to the core-Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

And of course, our invaluable open-source community!

v26.06 Release Candidate 1

Release Candidate 1 for Core Lightning v26.06

Highlights for Users

• graceful command to prepare CLN for shutdown... gracefully!
• Added sendamount command, to make a payment specifying the desired amount to send instead of the amount to be received.
• We've started the cycle to deprecate pay and focus our efforts on xpay. xpay now handles pay command by default (use xpay-handle-pay=false to prevent this) and we now use xpay not pay for paying invoices made with invoicerequest().
• xpay now accepts label and localinvreqid parameters (like pay).
• xpay will now update for the current payment if it gets a channel_update in an error message.
• xkeysend command for keysend with modern routing support.
• invoice_creation notification now includes offer_id when the invoice is associated with a BOLT 12 offer.

Highlights for Developers

• JSON-RPC: createproof to create a payment proof for a (successful) BOLT12 payment.
• JSON-RPC: decode now supports the lnp payer proof format.
• Plugins: bwatch plugin (enable using plugin=bwatch)

Protocol Updates

• message-padding defaults to false, due to poor detection of broken implementations.
• We now wait 72 blocks, not 12, before closing channels (BOLT update)

See the changelog for full details

Since v26.04 we’ve had 211 commits in 22 days by 17 authors.

A special mention to our three first time contributors:

@nGoline
@MSimeZ
@Andezion

An enormous thanks to the core-Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

v26.04.1 Negative Routing Fees I

What's Changed

This is a hotfix release addressing build and protocol correctness issues found shortly after v26.04.

Fixed

• Gossip: Malformed channel_announcement messages where node_id_1 is not lexicographically less than node_id_2 are now rejected per BOLT spec (lightning/bolts#1333), preventing gossip store corruption and stress on readers. ([#9082])
• Build: Fixed printf format specifiers for splice weight logging (%zu for size_t) across lightningd, channeld, and the spender plugin, resolving -Werror/-Wformat failures in Docker and 32-bit ARM cross-compilation. ([#9083], [#9086])
• Build: Removed __int128 usage from bookkeeper currency rate math, restoring builds on 32-bit targets (armv7). ([#9085])

Contributors

Thanks to the Core Lightning team for their work on this release
An enormous thanks to the Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

v26.04 Negative Routing Fees

This release has been named by @Chand-ra

Highlights for Users

• bkpr-report introduces a more flexible way to summarize Bookkeeper income, making it easier to break down earnings by category and period.
• New command splicein allows for convenient splicing funds into a channel.
• New command spliceout for easily splicing out of channels.
• New ability to "cross-splice" between two channels by specifying a second channel id as the destination of spliceout.
• You can now add a note when paying (payer-note in xpay).
• listpeerchannels can filter by channel_id, so you can zoom in on one channel without parsing the full list.
• Improved payment reliability through parallel pathfinding and multiple bug fixes in askrene.
• offer now includes a fronting_nodes option, while the new payment-fronting-node config allows you to specify preferred peers that help route payers to your invoices and offers across both BOLT11 and BOLT12 flows.
• Offer-related RPCs now expose decoded descriptions directly, making it easier to inspect, debug, and understand incoming and outgoing offers without manual decoding.
• gossipd offloads gossip_store compaction to a helper, improvin startup time especially for larger nodes while keeping the store around ~200MB.
• New currencyrate plugin exposes a currencyconvert RPC, enabling real-time conversion between Bitcoin and fiat currencies directly within Core Lightning.
• Most binaries are ~20% smaller .
• keysend now uses a final CLTV of 42 (instead of 22), improving compatibility with LDK nodes.

Highlights for Developers

• clnrest-register-path allows plugins to register custom HTTP endpoints at runtime, enabling dynamic REST APIs without restarting the node.
• bcli plugin is now synchronous: Simplifies the codebase and improves reliability of Bitcoin backend interactions by removing async complexity and queueing.
• Core Lightning builds are reproducible/deterministic on Fedora targets.
• Plugin options can now accumulate multiple values ("multi": true).
• STRICT tables and additional safety pragmas improve correctness and catch issues earlier during development.
• Lightningd now uses a more efficient ring buffer for logs, reducing overhead and simplifying log handling.
• Peer messages are now padded to a uniform length, mitigating traffic analysis and making it harder to infer node activity from message sizes.

Protocol Updates

• Splicing is now enabled by default!
• Legacy onion format support is removed (aligned with current interop, e.g. recent LND behavior).
• A splicing fix avoids an occasional hang when there is a pending closing HTLC during splice.

See the changelog for full details

Since v25.12 we’ve had 421 commits in 110 days by 23 authors

A special thanks to our three first time contributors:

@ScuttoZ
@Raimo33
@TatianaMoroz
@dovgopoly
@erdoganishe
@Nazarevsky

An enormous thanks to the Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @endothermicdev, @cdecker, @nepet, @Lagrang3, @daywalker90 and @niftynei

v26.04 Negative Routing Fees Release Candidate 3

This release has been named by @Chand-ra

Release Candidate 3 for Core Lightning v26.04

Highlights for Users

• bkpr-report introduces a more flexible way to summarize Bookkeeper income, making it easier to break down earnings by category and period.
• New command splicein allows for convenient splicing funds into a channel.
• New command spliceout for easily splicing out of channels.
• New ability to "cross-splice" between two channels by specifying a second channel id as the destination of spliceout.
• You can now add a note when paying (payer-note in xpay).
• listpeerchannels can filter by channel_id, so you can zoom in on one channel without parsing the full list.
• Improved payment reliability through parallel pathfinding and multiple bug fixes in askrene.
• offer now includes a fronting_nodes option, while the new payment-fronting-node config allows you to specify preferred peers that help route payers to your invoices and offers across both BOLT11 and BOLT12 flows.
• Offer-related RPCs now expose decoded descriptions directly, making it easier to inspect, debug, and understand incoming and outgoing offers without manual decoding.
• gossipd offloads gossip_store compaction to a helper, improvin startup time especially for larger nodes while keeping the store around ~200MB.
• New currencyrate plugin exposes a currencyconvert RPC, enabling real-time conversion between Bitcoin and fiat currencies directly within Core Lightning.
• Most binaries are ~20% smaller .
• keysend now uses a final CLTV of 42 (instead of 22), improving compatibility with LDK nodes.

Highlights for Developers

• clnrest-register-path allows plugins to register custom HTTP endpoints at runtime, enabling dynamic REST APIs without restarting the node.
• bcli plugin is now synchronous: Simplifies the codebase and improves reliability of Bitcoin backend interactions by removing async complexity and queueing.
• Core Lightning builds are reproducible/deterministic on Fedora targets.
• Plugin options can now accumulate multiple values ("multi": true).
• STRICT tables and additional safety pragmas improve correctness and catch issues earlier during development.
• Lightningd now uses a more efficient ring buffer for logs, reducing overhead and simplifying log handling.
• Peer messages are now padded to a uniform length, mitigating traffic analysis and making it harder to infer node activity from message sizes.

Protocol Updates

• Splicing is now enabled by default!
• Legacy onion format support is removed (aligned with current interop, e.g. recent LND behavior).
• A splicing fix avoids an occasional hang when there is a pending closing HTLC during splice.

See the changelog for full details

Since v25.12 we’ve had 421 commits in 110 days by 23 authors

A special thanks to our three first time contributors:

@ScuttoZ
@Raimo33
@TatianaMoroz
@dovgopoly
@erdoganishe
@Nazarevsky

An enormous thanks to the Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @endothermicdev, @cdecker, @nepet, @Lagrang3, @daywalker90 and @niftynei