Core Lightning warns node operators of vulnerabilities, urges offline mode pending patch

Aug 26, 2026

Core Lightning developers have issued an emergency warning to node operators after a flood of AI-generated security reports uncovered several genuine software vulnerabilities. To protect funds, developers urge operators to install forthcoming signed binary updates promptly. Those unable to upgrade immediately are advised to run their nodes in offline mode rather than powering them down, ensuring the software can still monitor the blockchain and prevent counterparties from force-closing channels with outdated balances. Technical details of the flaws remain under a strict two-week embargo.

Core Lightning vulnerability disclosure

▪Core Lightning developers confirmed that several software vulnerabilities flagged in a wave of AI-generated security reports are real and require fixes
▪The confirmed Core Lightning vulnerabilities are separate from remote denial-of-service flaws disclosed and patched in May and July 2026
▪Core Lightning has not disclosed the exact nature, severity, or quantity of the confirmed vulnerabilities, nor whether any exploitation has occurred

AI-generated security report flood

▪The volunteer group Bitcoin Red Team used AI models to identify 4,962 potential findings across 390 Bitcoin projects, initially rating 85 as critical
▪Core Lightning received a high volume of AI-generated vulnerability reports from multiple sources over a 10-day period starting around August 13, 2026

Node operator offline guidance

▪The --offline flag blocks peer connections and stops payment routing while allowing the Core Lightning daemon to continue monitoring the Bitcoin blockchain
▪Pseudonymous developer Calle publicly characterized the Core Lightning issue as a critical vulnerability and urged operators to shut down their nodes immediately
▪Core Lightning advised node operators who cannot immediately upgrade to restart their nodes with the --offline flag rather than shutting them down completely

Two-week embargo period

▪Core Lightning developers are keeping the technical details of the vulnerabilities under embargo for two weeks to allow operators time to upgrade
▪Core Lightning developer Christian Decker stated that withholding source patches for 14 days prevents attackers from reverse-engineering the fixes to develop exploits

Signed binary patch release

▪Core Lightning announced it will withdraw support for previous software releases, including version 26.04, due to the known security risks
▪The scheduled Core Lightning version 26.09 release remains planned for late September 2026
▪Core Lightning will distribute signed, reproducible binaries containing the security fixes while keeping the source code under embargo

Lightning Network channel funds

▪As of August 20, 2026, the Lightning Network carried approximately 3,750 BTC across 33,101 channels and 16,420 nodes, according to mempool.space
▪A powered-off Lightning node cannot monitor the blockchain or respond if a counterparty attempts to force-close a channel with an outdated balance
▪The Core Lightning alert follows other recent Bitcoin infrastructure security incidents, including a BTCPay Server credential flaw and a Coldcard wallet seed generation bug