Docker Images for Bitcoin Core Lightning v26.06.7 Served Without Security Fixes

Maintainers of Bitcoin Core Lightning discovered that Docker images tagged as v26.06.7, latest, v26.06.7‑vls and latest‑vls were released without the security fixes included in the v26.06.7 source code. The images displayed the correct version number at startup, but the binaries were still vulnerable.

Scope of the issue

The faulty images were published between 28 August 2023 16:04 UTC and 1 September 2023. An automated build process used a placeholder tag, causing the incorrect manifests to be pushed to Docker Hub.

Corrective actions

Maintainers have replaced the affected images and removed references to the incorrect manifests. Operators who previously pulled any of the four tags must compare the image digest (the SHA‑256 hash) against the corrected values and, if they differ, pull the updated image.

Correct digests

• elementsproject/lightningd:v26.06.7 (standard) – sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4
• elementsproject/lightningd:v26.06.7‑vls – sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f

To inspect a local image, use:

docker image inspect --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7

If the digest does not match, pull the corrected image:

docker pull elementsproject/lightningd:v26.06.7

For the VLS variant, use the corresponding vls tag and digest.

Embargo on source code

The v26.06.7 release is under a 14‑day embargo, with the source code slated for public disclosure on 11 September 2023. During this period, GitHub’s automatically attached source archives do not contain the patched code, and building from those archives will not produce the fixed binaries.

Impact on operators

Operators who upgraded from v26.06.6 or earlier are unaffected, as the packaging mistake only concerns the v26.06.7 images. Those who attempted the upgrade must verify their Docker images and, if necessary, re‑pull the corrected versions before the vulnerability window closes.