{"id":12991,"date":"2026-09-09T09:10:25","date_gmt":"2026-09-09T09:10:25","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12991"},"modified":"2026-09-09T09:10:25","modified_gmt":"2026-09-09T09:10:25","slug":"bitcoin-core-lightning-docker-bug-leaves-node-operators-exposed-despite-showing-updated-version","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12991","title":{"rendered":"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>The Bitcoin Lightning software&#8217;s maintainers say four image tags delivered unpatched binaries while reporting version v26.06.7 at startup, leaving affected users with another task: check the image digest and download a corrected image if it differs.<\/p>\n<p>Some Core Lightning operators who attempted the v26.06.7 upgrade through Docker may still be missing its security fixes.<\/p>\n<p>The updated release notice identifies the affected tags as <code>v26.06.7<\/code>, <code>latest<\/code>, <code>v26.06.7-vls<\/code> and <code>latest-vls<\/code>. They served images without the release&#8217;s fixes between Aug. 28 at 16:04 UTC and Sept. 1. The notice gives no precise end time.<\/p>\n<p>An automated build process published the images from a placeholder tag. Maintainers say they have replaced them and removed every tag&#8217;s reference to the incorrect manifests. But an operator who retained a faulty image cannot rely on its startup version to confirm the patch arrived.<\/p>\n<figure id=\"attachment_561058\" aria-describedby=\"caption-attachment-561058\" style=\"width: 1122px\" class=\"wp-caption aligncenter\"><img fetchpriority=\"high\" decoding=\"async\" class=\"wp-image-561058 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114.png\" alt=\"Core Lightning Docker correction timeline: four tags lacked fixes from Aug. 28 at 16:04 UTC to Sept. 1; verify digests and re-pull mismatches before planned Sept. 11 source disclosure.\" width=\"1122\" height=\"1402\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114-768x960.png 768w\" sizes=\"(max-width: 1122px) 100vw, 1122px\"\/><img decoding=\"async\" class=\"lazyload wp-image-561058 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114.png\" alt=\"Core Lightning Docker correction timeline: four tags lacked fixes from Aug. 28 at 16:04 UTC to Sept. 1; verify digests and re-pull mismatches before planned Sept. 11 source disclosure.\" width=\"1122\" height=\"1402\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-4a630d57-9e89-496c-9e88-6d24ca71b114-768x960.png 768w\" data-sizes=\"(max-width: 1122px) 100vw, 1122px\"\/><figcaption id=\"caption-attachment-561058\" class=\"wp-caption-text\">Infographic shows faulty Core Lightning Docker images served under four tags, followed by corrected releases and guidance to verify image digests.<\/figcaption><\/figure>\n<p>The Aug. 28 release set a 14-day embargo on publishing its source, pointing to a planned Sept. 11 disclosure. As of Sept. 8, the notice still describes that publication as upcoming. Maintainers say the delay gives operators time to upgrade before prospective attackers can reverse-engineer the fixes.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining the Daily Brief\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Daily Brief <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">The signal, before the noise.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start your day with the crypto stories moving markets, decoded by CryptoSlate\u2019s editors.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__form-heading\">One email. Everything that matters.<\/p>\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Free to join. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span><strong>You\u2019re on the list.<\/strong> Your next Daily Brief is on its way.<\/span><\/p>\n<\/div>\n<\/div>\n<\/aside>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Onslaught of AI-found bugs forces Bitcoin&#8217;s Core Lightning into a secret 14-day emergency lockdown<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<h2>How to check the Docker image to fix the Lightning bug<\/h2>\n<p>Maintainers ask anyone who previously pulled one of the four tags to compare its digest, the image&#8217;s identifying hash, against the corrected values:<\/p>\n<table>\n<thead>\n<tr>\n<th>Docker tags<\/th>\n<th>Corrected digest<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>v26.06.7, latest<\/td>\n<td><code>sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4<\/code><\/td>\n<\/tr>\n<tr>\n<td>v26.06.7-vls, latest-vls<\/td>\n<td><code>sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>For the standard versioned image, the notice supplies this command to inspect the local image. Its output alone does not establish which image an existing container is running:<\/p>\n<pre><code>docker image inspect --format '{{index .RepoDigests 0}}' elementsproject\/lightningd:v26.06.7<\/code><\/pre>\n<p>If the digest differs, its corresponding download command is:<\/p>\n<pre><code>docker pull elementsproject\/lightningd:v26.06.7<\/code><\/pre>\n<p>The notice also supplies <code>docker pull elementsproject\/lightningd:latest<\/code> for that tag. VLS users need the separate VLS digest in the table. Their <code>VLS_CLN_VERSION<\/code> setting must also match <code>v26.06.7<\/code>, or <code>remote_hsmd_socket<\/code> will refuse to start; the signer itself remains VLS v0.14.0.<\/p>\n<p>Users pinned to v26.06.6 or earlier escaped this packaging mistake. The exemption concerns the faulty packaging; the new security fixes belong to v26.06.7.<\/p>\n<p>The packaging correction changes the operator&#8217;s immediate problem of an attempted upgrade may need to be checked again while that window remains open.<\/p>\n<p>Another download trap exists during the embargo. GitHub&#8217;s automatically attached source-code archives are not the v26.06.7 source, maintainers warn, so building those archives will not produce the advertised patched binaries.<\/p>\n<\/div>\n<p>Featured,Governance,Hacks,Technology,Bitcoin,BTCBitcoin,BTC#Bitcoin #Core #Lightning #Docker #bug #leaves #node #operators #exposed #showing #updated #version1788945025<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Bitcoin Lightning software&#8217;s maintainers say four image tags delivered unpatched binaries while reporting version v26.06.7 at startup, leaving affected users with another task: check the image digest and download a corrected image if it differs. Some Core Lightning operators who attempted the v26.06.7 upgrade through Docker may still be missing its security fixes. The<\/p>\n","protected":false},"author":1,"featured_media":12992,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,285,4425,1362,6813,532,65,2661,3549,1193,2675,6814,6815],"class_list":["post-12991","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-btc","tag-bug","tag-core","tag-docker","tag-exposed","tag-leaves","tag-lightning","tag-node","tag-operators","tag-showing","tag-updated","tag-version"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Four tags served images that reported v26.06.7 without its fixes, prompting digest checks before planned source disclosure.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12991\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version\" \/>\n<meta property=\"og:description\" content=\"Four tags served images that reported v26.06.7 without its fixes, prompting digest checks before planned source disclosure.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12991\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-09T09:10:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12991\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12991\",\"name\":\"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12991#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12991#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg\",\"datePublished\":\"2026-09-09T09:10:25+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Four tags served images that reported v26.06.7 without its fixes, prompting digest checks before planned source disclosure.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12991#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12991\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12991#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12991#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version - Crypto News: Latest Cryptocurrency News and Analysis","description":"Four tags served images that reported v26.06.7 without its fixes, prompting digest checks before planned source disclosure.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12991","og_locale":"en_US","og_type":"article","og_title":"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version","og_description":"Four tags served images that reported v26.06.7 without its fixes, prompting digest checks before planned source disclosure.","og_url":"https:\/\/cryptonews.uk.com\/?p=12991","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-09T09:10:25+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12991","url":"https:\/\/cryptonews.uk.com\/?p=12991","name":"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12991#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12991#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg","datePublished":"2026-09-09T09:10:25+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Four tags served images that reported v26.06.7 without its fixes, prompting digest checks before planned source disclosure.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12991#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12991"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12991#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/lightning-digest-check.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12991#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12991"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12991\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12992"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}