Core Lightning Docker tags reported v26.06.7 but served unpatched

Core Lightning maintainers reported that four Docker image tags — v26.06.7, latest, v26.06.7-vls and latest-vls — presented themselves as v26.06.7 at startup while delivering binaries that did not include the security fixes from the v26.06.7 release. The faulty images were served between Aug. 28 at 16:04 UTC and Sept. 1; an automated build process published images from a placeholder tag. The maintainers replaced the incorrect images and removed references to the wrong manifests.

A container’s startup output that reports v26.06.7 cannot confirm whether the running binary contains the fixes. Operators who pulled any of the four tags are asked to compare their local image digest against the corrected values and re-download the image if the digests differ.

The corrected digests are sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4 for the standard v26.06.7 and latest tags, and sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f for v26.06.7-vls and latest-vls. To inspect a local image, the notice supplies this command: docker image inspect –format ‘{{index . RepoDigests 0}}’ elementsproject/lightningd:v26.06.7. If the digest differs, pull the corrected image with docker pull elementsproject/lightningd:v26.06.7 or docker pull elementsproject/lightningd:latest. VLS users must use the VLS digest and download the matching VLS image.

The notice also specifies a VLS requirement: the VLS_CLN_VERSION setting must match v26.06.7, otherwise remote_hsmd_socket will refuse to start. The signer software remains at VLS v0.14.0. Operators who remain pinned to v26.06.6 or earlier were not affected by the packaging error, which related to image manifests rather than release content.

The v26.06.7 release included a 14-day embargo on publishing its source, with maintainers planning to disclose source code on Sept. 11. The maintainers warned that GitHub’s automatically attached source-code archives are not the v26.06.7 source and building from those archives will not produce the patched binaries.

Maintainers advised any operator who previously pulled one of the affected tags to verify the image digest and re-download the corrected image if necessary to ensure the security fixes are present.