Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version

The Bitcoin Lightning software's maintainers say four image tags delivered unpatched binaries while reporting version v26.06.7 at startup, leaving affected users with another task: check the image digest and download a corrected image if it differs.

Some Core Lightning operators who attempted the v26.06.7 upgrade through Docker may still be missing its security fixes.

The updated release notice identifies the affected tags as v26.06.7, latest, v26.06.7-vls and latest-vls. They served images without the release's fixes between Aug. 28 at 16:04 UTC and Sept. 1. The notice gives no precise end time.

An automated build process published the images from a placeholder tag. Maintainers say they have replaced them and removed every tag's reference to the incorrect manifests. But an operator who retained a faulty image cannot rely on its startup version to confirm the patch arrived.

The Aug. 28 release set a 14-day embargo on publishing its source, pointing to a planned Sept. 11 disclosure. As of Sept. 8, the notice still describes that publication as upcoming. Maintainers say the delay gives operators time to upgrade before prospective attackers can reverse-engineer the fixes.

How to check the Docker image to fix the Lightning bug