-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0318
============================================================

Advisory-ID:  0xCERT-2026-0318
Severity:     High
Published:    2026-11-04T13:34:00.000Z
Updated:      2026-11-06T16:44:02.862Z
Chains:       Bitcoin
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0318

Title: Core Lightning 26.06.10 fixes dual-funding, splicing, runes/commando and remote-crash vulnerabilities

Summary
- -------
Core Lightning 26.06.10 fixes multiple reported vulnerabilities in dual funding, splicing, onchaind, gossip, connectd, runes/commando, plugin hooks and hsmd, plus remote-crash bugs. Maintainers strongly urge all operators to upgrade and to review and rotate issued runes.

Details
- -------
Summary
Core Lightning (CLN) 26.06.10 is a point release with fixes for vulnerabilities reported by multiple parties. The maintainers "strongly recommend upgrading" and "strongly encourage everyone to upgrade to 26.06.10 as soon as practical." The fixes are not under embargo. The maintainers are withholding the tests for the fixes to give node operators time to update.

Affected
- - Core Lightning before 26.06.10
- - Fixed in 26.06.10

Impact
The release notes list security fixes in dual funding and splicing, including signature checks on the peer's tx_signatures, along with fixes in onchaind HTLC resolution, gossip resource limits, connectd, runes and commando, plugin hooks and hsmd, "plus a number of remote-crash and hardening fixes." The Defiant reports that the fixes address channel-balance risks and remote crashes. The release notes do not list CVE identifiers and do not state whether these flaws have been exploited in the wild. Dual funding (--experimental-dual-fund) is still experimental.

Recommended actions
- - Upgrade to Core Lightning 26.06.10. Verify signatures and checksums against the published signed manifest.
- - Review the runes issued on your node. Bind runes to specific nodes and rotate any you cannot account for.

Source & attribution
This 0xCERT advisory summarises the Core Lightning 26.06.10 release notes by the Core Lightning maintainers (ElementsProject), which credit Vincenzo Palazzo, labrat-guy, Erick C, Paul Lamb, Kyle W. Santiago, The Bitcoin Red Team, 0xaudron, whkim0, Ahmadsm2005, Ben Carman, Michael1011, Nishant Bansal, Nuhiat Arefin, Matt Morehouse, Niklas Gögge, 3cola, Project Loupe, haoxucu, moinaiagent and others: https://github.com/ElementsProject/lightning/releases/tag/v26.06.10. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/ElementsProject/lightning/releases/tag/v26.06.10
- - https://thedefiant.io/news/security/core-lightning-urges-upgrade-to-26-06-10-to-patch-channel-flaws

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrwuCEJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfXR4g9I/fEK5vwIuMAOhpP+1rxMLJPTcbHwm8b
lbbw1hYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAACBAEAtzdVFHYuOyUqYEK9
Om9E8VKctvhPHsWNtwWrWEIncQgA/2y74wMqQpfX93/2u/5gBoyh14HSL4jS
q/cEXG8QuiUJ
=R9Vn
-----END PGP SIGNATURE-----