Core Lightning Discloses Software Flaw, Urges Node Operators to Go Offline Immediately

Core Lightning, an implementation of Bitcoin’s Lightning Network, disclosed a software vulnerability and urged node operators to take affected nodes offline immediately. A patched version has not yet been released.

Bitcoin News, a cryptocurrency-focused media outlet, reported on August 26 that Core Lightning had published a CVE report on the flaw and recommended steps for affected node operators.

The vulnerability affects all nodes running Core Lightning, or CLN, version 26.04 or earlier. Support for those versions has been discontinued, and specific technical details of the flaw were not disclosed.

Details of the vulnerability will remain under embargo for two weeks. The measure is intended to give operators time to respond before the flaw can be exploited in an actual attack.

Core Lightning recommended that affected nodes be taken offline immediately because a patch is not yet available.