Core Lightning has confirmed multiple security vulnerabilities in its software and is preparing a security update to address them. Until that patch is installed, the team is advising node operators to switch to offline mode — a state that keeps nodes running but disconnected from the network.
What the vulnerabilities affect
The exact nature of the flaws hasn't been disclosed in detail, but the confirmation covers more than one issue. That's enough for the developers to treat the situation as urgent. Operators who run Core Lightning nodes are being told to act before the update lands.
The advisory is blunt: if you don't install the update, go offline. Offline mode doesn't shut the node down — it keeps it active but cuts its connection to the wider Lightning Network. That means the node won't route payments or sync new data, but it also won't be exposed to whatever the vulnerabilities allow.
Why offline mode matters
For many operators, disconnecting isn't a trivial choice. Nodes that go offline can miss channel updates, and in some setups that creates operational friction. But the team is making clear that the risk of staying connected without the patch is worse. The recommendation is a stopgap, not a permanent fix.
The security update is in preparation, which suggests it hasn't been released yet. There's no public timeline for when it will be ready. In the meantime, operators are left with two options: install the patch when it arrives, or keep the node in offline mode until they can.
What operators should do now
Anyone running a Core Lightning node should check the official channels for the update and plan to apply it as soon as it's available. Until then, the safest move is to follow the offline-mode guidance. The team hasn't said how long the window will be, but the message is clear — don't wait.
The update's release will be the next concrete milestone. Until it's out, the decision rests with each operator: stay connected and take the risk, or go offline and wait.
