CVE-2020-26896

HIGH EPSS 49.6%
Published Oct 21, 20205y ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
High
Find Similar
Published Oct 21, 2020 5y ago
Last Modified Jun 17, 2026 2w ago

Description

Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collision with an invoice, the preimage for an expected payment was instead released. A malicious peer could have deliberately intercepted an HTLC intended for the victim node, probed the preimage through a colluding relayed HTLC, and stolen the intercepted HTLC. The impact is a loss of funds in certain situations, and a weakening of the victim's receiver privacy.

CVSS Details

Base Score
8.2
Exploitability
3.9
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
49.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-354

Affected Products 6

VendorProductVersionRange
lightning_network_daemon_projectlightning_network_daemon* <0.11.0
lightning_network_daemon_projectlightning_network_daemon0.11.0any
lightning_network_daemon_projectlightning_network_daemon0.11.0any
lightning_network_daemon_projectlightning_network_daemon0.11.0any
lightning_network_daemon_projectlightning_network_daemon0.11.0any
lightning_network_daemon_projectlightning_network_daemon0.11.0any

References 3

  • gist.github.com https://gist.github.com/ariard/6bdeb995565d1cc292753e1ee4ae402d
    Third Party Advisory
  • lists.linuxfoundation.org https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002855.html
    Mailing ListThird Party Advisory
  • lists.linuxfoundation.org https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html
    Mailing ListPatchThird Party Advisory

Remediation

  • lists.linuxfoundation.org https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html
    Mailing ListPatchThird Party Advisory