Core Lightning: Is Your Docker Update Verified?

When your Core Lightning node prints v26.06.7 at startup, that is no proof that the security fixes in this version are actually running. Anyone who pulled their update via Docker between August 28, 2026, 16:04 UTC, and September 1 may be running an image that reports itself correctly and still does not contain the fixes. The reliable evidence is the image digest, not the version output. This piece walks you through the check that requires, and through what to do afterwards.

The situation has changed in two places since our article of August 30: the faulty Docker window is now documented in the release note, and the embargo on the source code expired on September 11. Both change what you as an operator need to do.

What Core Lightning is and why this update concerns you

Core Lightning (formerly c-lightning) is one of three widely used implementations of the Lightning protocol, written in C and maintained in the ElementsProject/lightning repository. An implementation here is simply a standalone program that applies the same network rules as the competing programs but has its own code and therefore its own bugs.

The Lightning network itself is a second layer on top of the Bitcoin blockchain: two parties jointly lock funds in a payment channel and then settle any number of payments between them without writing every single one to the chain. Whoever runs such a node holds the keys to those locked funds themselves. That is what makes this serious: a bug in the node software directly affects Bitcoin that belongs to you and that nobody else is watching over.