CVE-2020-26896
HIGH EPSS 49.6%
Published Oct 21, 20205y ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
Published Oct 21, 2020 5y ago
Last Modified Jun 17, 2026 2w ago
Description
Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collision with an invoice, the preimage for an expected payment was instead released. A malicious peer could have deliberately intercepted an HTLC intended for the victim node, probed the preimage through a colluding relayed HTLC, and stolen the intercepted HTLC. The impact is a loss of funds in certain situations, and a weakening of the victim's receiver privacy.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity High
Availability None
Threat Intelligence
EPSS Exploit Probability
49.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-354
Affected Products 6
| Vendor | Product | Version | Range |
|---|---|---|---|
| lightning_network_daemon_project | lightning_network_daemon | * | <0.11.0 |
| lightning_network_daemon_project | lightning_network_daemon | 0.11.0 | any |
| lightning_network_daemon_project | lightning_network_daemon | 0.11.0 | any |
| lightning_network_daemon_project | lightning_network_daemon | 0.11.0 | any |
| lightning_network_daemon_project | lightning_network_daemon | 0.11.0 | any |
| lightning_network_daemon_project | lightning_network_daemon | 0.11.0 | any |
References 3
- gist.github.com https://gist.github.com/ariard/6bdeb995565d1cc292753e1ee4ae402d
- lists.linuxfoundation.org https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002855.html
- lists.linuxfoundation.org https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html
Remediation
- lists.linuxfoundation.org https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html