Core Lightning patches channel-close flaw that could bypass Lightning Network penalty mechanism

Core Lightning, a Lightning Network node implementation, fixed a channel-close flaw in v26.06.7 that could let a peer broadcast an old, revoked channel state without triggering the penalty for cheating. Bitcoin Optech's Sept. 25 explanation of the now-public patch makes the risk concrete for operators still running older builds.

Lightning peers replace earlier channel commitments as balances change. If one broadcasts a revoked commitment, the counterparty should be able to claim a penalty. Before the fix, Core Lightning could instead treat that funding spend as a cooperative close when its outputs matched shutdown scripts already on record.

That depended on a specific channel setup. A peer that had not specified an upfront shutdown script when the channel opened could later name the output script of its revoked commitment in a shutdown message. It could then abandon the cooperative close and broadcast the old commitment. Matching the outputs alone made the transaction look legitimate, bypassing the penalty path, according to the maintainers' patch notes and regression test.

The repair checks a transaction's locktime and sequence encoding to recognize a commitment before looking at its outputs as a possible mutual close. The materials describe a potential way to evade the penalty, not a confirmed theft. This is a Core Lightning channel-handling issue, not a change to Bitcoin's base-chain rules.

What operators should check

A Core Lightning build older than the fixed v26.06.7 release needs an update. The project strongly recommends v26.06.8, a later security release with additional fixes. The revoked-close path requires the shutdown-script condition above, so a vulnerable software version does not mean every channel could be exploited that way.

Operators who used Docker images during the earlier rollout should also verify the image digest. The project's v26.06.7 release notes say that images served under v26.06.7 and related tags from Aug. 28 to Sept. 1 reported the new version on startup but lacked its fixes. The project lists the corrected digests and instructs users with a mismatch to re-pull the image.

The version history separates the two patches. Core Lightning shipped v26.06.7 on Aug. 28, then published its initially embargoed release source code on Sept. 11. Pull request 9509, merged into the main development branch Sept. 15, carried those changes forward. V26.06.8 followed Sept. 22 with other security fixes and immediately available source, though a few tests remained withheld. Optech's Sept. 25 report explained the already-shipped revoked-close repair.