Core Lightning confirms vulnerabilities, advises node operators on security steps

Core Lightning, the open-source implementation of Bitcoin's Lightning Network, has confirmed multiple vulnerabilities following a review of a large volume of AI-generated security reports. The project disclosed on Thursday that while many such reports are false positives, several vulnerabilities are genuine.

To protect their nodes without fully shutting down the software, operators are advised to restart with the "--offline" flag, which prevents payments from entering, leaving or routing through the node while keeping the daemon active. This allows nodes to follow the Bitcoin blockchain and respond if a counterparty force-closes a channel, a capability that stopped nodes cannot perform. Core Lightning stated that upgrading to the forthcoming security update remains its primary recommendation, and operators using offline mode should remove the flag after upgrading to restore connectivity.

The project has not disclosed the nature or severity of the vulnerabilities, has not published CVE identifiers, and has reported no known exploitation or losses. These flaws are separate from remote denial-of-service vulnerabilities patched in earlier releases following disclosures in May and July.