On August 27, 2026, Core Lightning confirmed multiple security vulnerabilities across its node software. Developers evaluated a large batch of AI-generated bug reports and verified that several submissions identified legitimate flaws requiring immediate engineering fixes.
Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.
What to do now: do not shut your node down. Restart it with –offline.
That flag stops peer connections, so no payments route in,…
— Core Lightning ⚡️ (@Core_LN) August 26, 2026
The development team advised operators to keep their daemons active while isolating them from the network using the --offline flag. This temporary setting blocks incoming, outgoing, and routed payments without shutting down the core software entirely.
To be clear about what we are recommending: you do not need to shut your node down.
Our advice is to upgrade. When the release lands, verify the signatures and install it, and do that promptly rather than eventually.
–offline is the alternative for anyone who is not going to… https://t.co/rjq8Haz4pE
— Core Lightning ⚡️ (@Core_LN) August 27, 2026
In a follow-up announcement, Core Lightning prioritized the forthcoming update as the primary remediation path. The offline configuration was clarified as a temporary stopgap strictly intended for node runners unable to deploy the patched release immediately.
Channel protection and continuous monitoring
Maintaining the daemon in a running state allows the node to track the Bitcoin network continuously. This persistent operation ensures the system maintains local channel state data without exposing the routing layer to external traffic.
Direct visibility over the Blockchain is essential for detecting unilateral or forced channel closures by counterparties. If a node were completely shut down, it could not broadcast penalty transactions in time to protect committed channel balances.
Under the offline configuration, the software rejects inbound peer connections and stops outgoing peer communication. However, internal tracking mechanisms and local transaction validation routines continue to operate without disruption.
Once operators complete the upgrade, they must remove the offline parameter before relaunching the node. Failing to delete this flag leaves the daemon permanently isolated and unable to process transactions across the network.
Disclosure terms and security history
Core Lightning has not published specific CVE identifiers, severity metrics, or affected subdaemons publicly. Technical vulnerability details will remain under a two-week confidentiality embargo to give node runners adequate time to install patches safely.
The project stated there is no evidence of exploitation or financial loss connected to these findings. The preemptive guidance aims to safeguard infrastructure before automated bug reports can be converted into working exploits.
These newly verified issues are separate from denial-of-service vulnerabilities disclosed in May and July 2026. Those prior bugs involved remote memory exhaustion crashes in the connectd and gossipd daemons, which received patches in earlier releases.
Operational recommendations for node runners
The disclosure follows an influx of vulnerability submissions generated by automated machine-learning models. While automated security tooling frequently creates false positives, thorough manual code reviews confirmed that several reported vectors presented genuine risks to the software.
Operators running prepackaged node bundles should verify their underlying binary versions directly. Packaged node distributions often lag behind upstream repository releases, which can leave automated environments exposed if maintainers delay publishing packaged updates.
For routing nodes managing high-capacity channels, executing cooperative closures before any extended downtime reduces operational risks. Coordinating with channel peers prevents unexpected unilateral settlement procedures during periods of temporary network disconnection.
The Core Lightning team will release signed release binaries to initiate the network-wide patching cycle. Infrastructure resilience depends on how swiftly node administrators apply the official update across their production servers.
Legacy versions, including release 26.04 and earlier iterations, will no longer receive maintenance support moving forward. Operators must migrate to officially supported releases to maintain ongoing protocol compatibility and secure node performance.
This article is for informational purposes only and does not constitute financial advice.
