# Core Lightning channel security fixes

> Maintainers corrected channel funding, splicing, payment resolution and remote access vulnerabilities.

- URL: https://riadefi.com/on-chain/2026-11-04-core-lightning-security-fixes/
- Type: Security incident
- Stage: Confirmed
- Evidence: confirmed
- Materiality: material
- Event date: 2026-11-04
- Version: 1, published 2026-11-05 (first published 2026-11-05)
- Follow-up: 2026-11-06
- Advisor-relevant: yes
- Affects: Lightning Network (protocol)

## What happened

Core Lightning maintainers released security fixes on November 4, 2026, and urged operators to upgrade.

## What changed

Maintainers corrected channel funding, splicing, payment resolution and remote access vulnerabilities.

## What did not change

Maintainers continue to classify dual funding as experimental and discourage trusting unknown peers with unconfirmed channels.

## Confirmed

- Maintainers included signature checks for channel transactions and fixes for resolving conditional payments on-chain.
- Maintainers temporarily withheld security tests to give operators more time to upgrade.
- Maintainers recommended restricting remote access credentials and replacing credentials that operators cannot account for.

## Still open

- Maintainers did not establish losses or exploitation in this release notice.
- The notice does not establish which service providers have installed the fixes.

## What it means for an advisor

- Ketju should review the Lightning memo's node security and channel settlement requirements.
- Ketju should confirm affected providers' upgrade status before relying on their payment services.

## Sources

1. [Core Lightning security release of November 4, 2026](https://github.com/ElementsProject/lightning/releases/tag/v26.06.10) · Core Lightning maintainers · 2026-11-04


---

Published by Ketju Research on RIADeFi (https://riadefi.com). Educational research for financial professionals; not investment, legal, tax, or compliance advice.