This point release includes fixes for vulnerabilities responsibly reported by a number of sources. It also comes at a time when increasingly capable AI models are being used to identify potential vulnerabilities in open-source code, significantly increasing the volume and pace of security reports.

The potential impact and associated risks are front of mind for everyone involved, not least the remediation team who have worked tirelessly to triage, resolve, and compile this release.

This embargo period will last for two weeks. The source code will not be published until 14 days have passed. During this time, we strongly encourage everyone to upgrade. At the end of this two-week period, the full release details will be made available.

This delay is designed to reduce the chances of prospective attackers reverse-engineering the fixes and exploiting them before the network can update.

Upgrading

Download the tarball for your platform below, verify it (see next section), then unpack it over your existing installation:

sudo tar -xvf <release>.tar.xz -C /usr/local --strip-components=2

Restart lightningd afterwards. No database migration steps are required beyond the automatic ones applied at startup.

Docker users

Docker images are not yet available and will follow shortly after this release. Do not wait for them to upgrade — the tarballs above are the release, and upgrading promptly is the whole point of the embargo period.

⚠️ The Docker images currently published for this release are not correct and must not be used.

elementsproject/lightningd:v26.06.7 and elementsproject/lightningd:latest were published automatically by CI and do not contain the fixes in this release, despite reporting v26.06.7 on startup. Corrected images will replace them shortly and this notice will be removed.

If you have already pulled, check which image you have:

docker image inspect --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7

If the digest begins sha256:f0bd6bf2, you have the incorrect image. Do not run it as an upgrade; re-pull once this notice is removed.

Users pinned to v26.06.6 or earlier are unaffected.

Upgrade using the tarballs above rather than waiting for Docker. They are the release, they are signed, and upgrading promptly is the whole point of the embargo period.

Verifying your download

Every binary is covered by a signed manifest. Check the checksums first:

sha256sum -c SHA256SUMS-v26.06.7 --ignore-missing

Then the signatures:

gpg --verify SHA256SUMS-v26.06.7.asc SHA256SUMS-v26.06.7

SHA256SUMS-v26.06.7 covers the amd64 tarballs and is signed by maintainers. SHA256SUMS-v26.06.7-arm64 covers the arm64 tarballs and has its own signature file. Signing keys:

Fetch them with gpg --recv-keys <fingerprint>, or from the contrib/keys/ directory of the repository once the source is published.

Reports Received from (No Particular Order)

• erickcestari
• project-loupe
• instagibbs
• benthecarman
• 0xaudron@Kvazar_AI
• callebtc
• haoxucu
• vincenzopalazzo
• ksedgwic
• jaonoctus
• whkim0
• Ahmadsm2005
• labrat-guy
• FrancisPouliot
• Bitcoin Red team
• moinaiagent@coinos.io

The Most Thoughtful Remediation Team

• nGoline
• cdecker
• ddustin
• daywalker90
• Lagrang3
• sangbida
• rustyrussell
• Andezion
• niftynei

Notes

The "Source code (zip)" and "Source code (tar.gz)" links that GitHub attaches to this release are not the v26.06.7 source. They are generated automatically and cannot be removed. The v26.06.7 source will be published when the embargo ends, 14 days from this release. Do not build from those archives expecting to get these binaries.

A commitment to the source has been published in advance. SHA256SUMS-v26.06.7 includes an entry for clightning-v26.06.7.zip, the source archive, even though that file is not attached to this release. Because the manifest is signed and published today, anyone can confirm when the source appears that it is the same source these binaries were built from, and that nothing was altered during the embargo.

Reproducing the binaries. Full build instructions will accompany the source release. This release was not built with the default optimisation settings, so a standard build will not reproduce these checksums; the exact parameters will be published alongside the source.

[26.06.6] - 2026-07-20: "Quantum-Resistant Lightning Channel VI"

v26.06.3, v26.06.4, and v26.06.5 had issues during publishing with the pypi releases and were deleted.

Fixed

• update pyln-proto's coincurve to a v21 fork to fix Python build environments (#9325)
• reject a channel that reuses an existing funding outpoint (#9318)

Contributors

Thanks to the Lightning team and our community contributors for their work on this release.

And, of course, to the core-Core Lightning team: @cdecker, @ShahanaFarooqui, @Lagrang3, @sangbida, @daywalker90, @nGoline, and @niftynei — carrying forward the work started by @rustyrussell, whose technical leadership and long-standing care for the project remain central to Core Lightning.

This point release if recommended for all minimal OS setups, including docker images, that have no root certificates for TLS installed.

Fixed

• cln-currencyrate: include root certificates to fix the builder error on OS's without root certificates. (#9255)

Contributors

Thanks to the Lightning team and our community contributors for their work on this release.

Special thanks to @ddustin—still splicing, still appreciated! 🙌

And of course, to the core-Core Lightning team: @rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

What's Changed

This point release fixes the bwatch plugin failure at registration.

Fixed

• Plugins: bwatch failed to register on startup after make install ([#9192])

Check out the updated Changelog

Contributors

Thanks to the Lightning team and our community contributors for their work on this release.

Special thanks to @ddustin—still splicing, still appreciated! 🙌

A shutout to the core-Core Lightning team: @rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

This release has been named by @enaples

Highlights for Users

• graceful command to prepare CLN for shutdown... gracefully!
• Added sendamount command, to make a payment specifying the desired amount to send instead of the amount to be received.
• We've started the cycle to deprecate pay and focus our efforts on xpay. xpay now handles pay command by default (use xpay-handle-pay=false to prevent this) and we now use xpay not pay for paying invoices made with invoicerequest().
• xpay now accepts label and localinvreqid parameters (like pay).
• xpay will now update for the current payment if it gets a channel_update in an error message.
• xkeysend command for keysend with modern routing support.
• invoice_creation notification now includes offer_id when the invoice is associated with a BOLT 12 offer.
• Removed fields no longer present in documentation / GRPC interfaces.
• Experimental payment proof implementation updated to latest draft
• gossipd made more robust against channel_update spamming.

Highlights for Developers

• JSON-RPC: createproof to create a payment proof for a (successful) BOLT12 payment.
• JSON-RPC: decode now supports the lnp payer proof format.
• Plugins: bwatch plugin (enable using plugin=bwatch)

Protocol Updates

• message-padding defaults to false, due to poor detection of broken implementations.
• We now wait 72 blocks, not 12, before closing channels (BOLT update)

See the changelog for full details

Since v26.04 we’ve had 236 commits in 42 days by 19 authors

A special mention to our three first time contributors:

@nGoline
@MSimeZ
@Andezion

A huge shout-out to @ddustin for his ongoing contributions and support. We truly appreciate your splicing—you really know how to keep things together! 🧬

An enormous thanks to the core-Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

This release has been named by @enaples

Release Candidate 2 for cln v26.06

This RC builds upon RC1, with these changes:

• Removed fields no longer present in documentation / GRPC interfaces.
• Experimental payment proof implementation updated to latest draft
• gossipd made more robust against channel_update spamming.

See the changelog for full details

An enormous thanks to the core-Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

And of course, our invaluable open-source community!

Release Candidate 1 for Core Lightning v26.06

Highlights for Users

• graceful command to prepare CLN for shutdown... gracefully!
• Added sendamount command, to make a payment specifying the desired amount to send instead of the amount to be received.
• We've started the cycle to deprecate pay and focus our efforts on xpay. xpay now handles pay command by default (use xpay-handle-pay=false to prevent this) and we now use xpay not pay for paying invoices made with invoicerequest().
• xpay now accepts label and localinvreqid parameters (like pay).
• xpay will now update for the current payment if it gets a channel_update in an error message.
• xkeysend command for keysend with modern routing support.
• invoice_creation notification now includes offer_id when the invoice is associated with a BOLT 12 offer.

Highlights for Developers

• JSON-RPC: createproof to create a payment proof for a (successful) BOLT12 payment.
• JSON-RPC: decode now supports the lnp payer proof format.
• Plugins: bwatch plugin (enable using plugin=bwatch)

Protocol Updates

• message-padding defaults to false, due to poor detection of broken implementations.
• We now wait 72 blocks, not 12, before closing channels (BOLT update)

See the changelog for full details

Since v26.04 we’ve had 211 commits in 22 days by 17 authors.

A special mention to our three first time contributors:

@nGoline
@MSimeZ
@Andezion

An enormous thanks to the core-Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

What's Changed

This is a hotfix release addressing build and protocol correctness issues found shortly after v26.04.

Fixed

• Gossip: Malformed channel_announcement messages where node_id_1 is not lexicographically less than node_id_2 are now rejected per BOLT spec (lightning/bolts#1333), preventing gossip store corruption and stress on readers. ([#9082])
• Build: Fixed printf format specifiers for splice weight logging (%zu for size_t) across lightningd, channeld, and the spender plugin, resolving -Werror/-Wformat failures in Docker and 32-bit ARM cross-compilation. ([#9083], [#9086])
• Build: Removed __int128 usage from bookkeeper currency rate math, restoring builds on 32-bit targets (armv7). ([#9085])

Contributors

Thanks to the Core Lightning team for their work on this release
An enormous thanks to the Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @cdecker, @nepet, @Lagrang3, @daywalker90, @nGoline and @niftynei

This release has been named by @Chand-ra

Highlights for Users

• bkpr-report introduces a more flexible way to summarize Bookkeeper income, making it easier to break down earnings by category and period.
• New command splicein allows for convenient splicing funds into a channel.
• New command spliceout for easily splicing out of channels.
• New ability to "cross-splice" between two channels by specifying a second channel id as the destination of spliceout.
• You can now add a note when paying (payer-note in xpay).
• listpeerchannels can filter by channel_id, so you can zoom in on one channel without parsing the full list.
• Improved payment reliability through parallel pathfinding and multiple bug fixes in askrene.
• offer now includes a fronting_nodes option, while the new payment-fronting-node config allows you to specify preferred peers that help route payers to your invoices and offers across both BOLT11 and BOLT12 flows.
• Offer-related RPCs now expose decoded descriptions directly, making it easier to inspect, debug, and understand incoming and outgoing offers without manual decoding.
• gossipd offloads gossip_store compaction to a helper, improvin startup time especially for larger nodes while keeping the store around ~200MB.
• New currencyrate plugin exposes a currencyconvert RPC, enabling real-time conversion between Bitcoin and fiat currencies directly within Core Lightning.
• Most binaries are ~20% smaller .
• keysend now uses a final CLTV of 42 (instead of 22), improving compatibility with LDK nodes.

Highlights for Developers

• clnrest-register-path allows plugins to register custom HTTP endpoints at runtime, enabling dynamic REST APIs without restarting the node.
• bcli plugin is now synchronous: Simplifies the codebase and improves reliability of Bitcoin backend interactions by removing async complexity and queueing.
• Core Lightning builds are reproducible/deterministic on Fedora targets.
• Plugin options can now accumulate multiple values ("multi": true).
• STRICT tables and additional safety pragmas improve correctness and catch issues earlier during development.
• Lightningd now uses a more efficient ring buffer for logs, reducing overhead and simplifying log handling.
• Peer messages are now padded to a uniform length, mitigating traffic analysis and making it harder to infer node activity from message sizes.

Protocol Updates

• Splicing is now enabled by default!
• Legacy onion format support is removed (aligned with current interop, e.g. recent LND behavior).
• A splicing fix avoids an occasional hang when there is a pending closing HTLC during splice.

See the changelog for full details

Since v25.12 we’ve had 421 commits in 110 days by 23 authors

A special thanks to our three first time contributors:

@ScuttoZ
@Raimo33
@TatianaMoroz
@dovgopoly
@erdoganishe
@Nazarevsky

An enormous thanks to the Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @endothermicdev, @cdecker, @nepet, @Lagrang3, @daywalker90 and @niftynei

This release has been named by @Chand-ra

Release Candidate 3 for Core Lightning v26.04

Highlights for Users

• bkpr-report introduces a more flexible way to summarize Bookkeeper income, making it easier to break down earnings by category and period.
• New command splicein allows for convenient splicing funds into a channel.
• New command spliceout for easily splicing out of channels.
• New ability to "cross-splice" between two channels by specifying a second channel id as the destination of spliceout.
• You can now add a note when paying (payer-note in xpay).
• listpeerchannels can filter by channel_id, so you can zoom in on one channel without parsing the full list.
• Improved payment reliability through parallel pathfinding and multiple bug fixes in askrene.
• offer now includes a fronting_nodes option, while the new payment-fronting-node config allows you to specify preferred peers that help route payers to your invoices and offers across both BOLT11 and BOLT12 flows.
• Offer-related RPCs now expose decoded descriptions directly, making it easier to inspect, debug, and understand incoming and outgoing offers without manual decoding.
• gossipd offloads gossip_store compaction to a helper, improvin startup time especially for larger nodes while keeping the store around ~200MB.
• New currencyrate plugin exposes a currencyconvert RPC, enabling real-time conversion between Bitcoin and fiat currencies directly within Core Lightning.
• Most binaries are ~20% smaller .
• keysend now uses a final CLTV of 42 (instead of 22), improving compatibility with LDK nodes.

Highlights for Developers

• clnrest-register-path allows plugins to register custom HTTP endpoints at runtime, enabling dynamic REST APIs without restarting the node.
• bcli plugin is now synchronous: Simplifies the codebase and improves reliability of Bitcoin backend interactions by removing async complexity and queueing.
• Core Lightning builds are reproducible/deterministic on Fedora targets.
• Plugin options can now accumulate multiple values ("multi": true).
• STRICT tables and additional safety pragmas improve correctness and catch issues earlier during development.
• Lightningd now uses a more efficient ring buffer for logs, reducing overhead and simplifying log handling.
• Peer messages are now padded to a uniform length, mitigating traffic analysis and making it harder to infer node activity from message sizes.

Protocol Updates

• Splicing is now enabled by default!
• Legacy onion format support is removed (aligned with current interop, e.g. recent LND behavior).
• A splicing fix avoids an occasional hang when there is a pending closing HTLC during splice.

See the changelog for full details

Since v25.12 we’ve had 421 commits in 110 days by 23 authors

A special thanks to our three first time contributors:

@ScuttoZ
@Raimo33
@TatianaMoroz
@dovgopoly
@erdoganishe
@Nazarevsky

An enormous thanks to the Core Lightning team:
@rustyrussell, @ShahanaFarooqui, @sangbida, @endothermicdev, @cdecker, @nepet, @Lagrang3, @daywalker90 and @niftynei