Core Lightning (or shortly CLN) one of the main software implementations of Bitcoin's Lightning Network, is preparing fixes for a series of vulnerabilities after receiving a wave of AI-generated security reports this month.
🟥 URGENT: Critical vulnerability in Core Lightning
— calle 🟥 (@callebtc) August 26, 2026
Blockstream developers urge users to shut down CLN Lightning nodes right NOW!
Please let everyone know! pic.twitter.com/4HpobzMs7Y
- Screenshots shared in a Wednesday post on X by Bitcoin developer Calle show the project initially said on Aug. 13 that it had received multiple AI-generated CVE reports over roughly 10 days and was working with open-source contributors to validate them.
- Blockstream, which develops and maintains Core Lightning, publicly posted the same warning that day and said a point release containing many of the fixes was being prepared.
- But by Aug. 23, the response had escalated.
Rather than immediately publishing the planned point release, the team said it would first make signed binaries containing fixes available while keeping the vulnerabilities themselves under a two-week embargo.
During that period, operators are being "strongly" encouraged to upgrade. Those who choose not to were given a considerably sharper recommendation: take the node offline.
Details stay hidden while fixes roll out
The team said the embargo is intended to give operators time to install patched software before full technical details become public. It also said previous affected releases, including version 26.04, would not be supported given the "known risks."
The vulnerabilities haven't yet been publicly described and there's no indication so far that they have been exploited in the wild or that funds have been lost.
That makes the warning more significant than the underlying severity can currently be judged. Core Lightning is stable software used on Bitcoin mainnet and has been in production since 2018, according to its GitHub repository.
Its latest publicly listed stable release remains v26.06.6, published in July, while the project said its larger v26.09 release is still planned for late September.
- Christian Decker, a longtime Bitcoin researcher at Blockstream, said the project was trying to avoid panic while rolling out the fixes.
- He said in an X post on Aug. 26 that Core Lightning plans to publish a binary-only point release within 48 hours, while keeping the source patches under embargo for 14 days to make it harder for attackers to reverse engineer the vulnerabilities before operators have time to upgrade.