Read the docs
TI-2020-16322 Aliases CVE-2020-26895

Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty…

Priority LOW 25CWE-354Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations.

Why it matters now

EPSS 0.00707 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 54

CPEVersionsRoleVendor
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.1:alpha:*:*:*:*:*:*0.1 alphaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.1.1:alpha:*:*:*:*:*:*0.1.1 alphaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.2:alpha:*:*:*:*:*:*0.2 alphaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.2.1:alpha:*:*:*:*:*:*0.2.1 alphaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.3:alpha:*:*:*:*:*:*0.3 alphaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.4:beta:*:*:*:*:*:*0.4 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.4.1:beta:*:*:*:*:*:*0.4.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.4.2:beta:*:*:*:*:*:*0.4.2 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta:*:*:*:*:*:*0.5 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta_rc1:*:*:*:*:*:*0.5 beta_rc1VulnerableLightning Network Daemon Project
Show 44 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta_rc2:*:*:*:*:*:*0.5 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta:*:*:*:*:*:*0.5.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc1:*:*:*:*:*:*0.5.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc2:*:*:*:*:*:*0.5.1 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc3:*:*:*:*:*:*0.5.1 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc4:*:*:*:*:*:*0.5.1 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.2:beta:*:*:*:*:*:*0.5.2 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta:*:*:*:*:*:*0.6 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc1:*:*:*:*:*:*0.6 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc2:*:*:*:*:*:*0.6 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc3:*:*:*:*:*:*0.6 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc4:*:*:*:*:*:*0.6 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta:*:*:*:*:*:*0.6.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta_rc1:*:*:*:*:*:*0.6.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta_rc2:*:*:*:*:*:*0.6.1 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta:*:*:*:*:*:*0.7.0 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc1:*:*:*:*:*:*0.7.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc2:*:*:*:*:*:*0.7.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc3:*:*:*:*:*:*0.7.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta:*:*:*:*:*:*0.7.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta_rc1:*:*:*:*:*:*0.7.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta_rc2:*:*:*:*:*:*0.7.1 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta:*:*:*:*:*:*0.8.0 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc1:*:*:*:*:*:*0.8.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc2:*:*:*:*:*:*0.8.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc3:*:*:*:*:*:*0.8.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.1:beta:*:*:*:*:*:*0.8.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta:*:*:*:*:*:*0.8.2 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta_rc1:*:*:*:*:*:*0.8.2 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta_rc2:*:*:*:*:*:*0.8.2 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta:*:*:*:*:*:*0.9.0 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc1:*:*:*:*:*:*0.9.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc2:*:*:*:*:*:*0.9.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc3:*:*:*:*:*:*0.9.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc4:*:*:*:*:*:*0.9.0 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.1:beta:*:*:*:*:*:*0.9.1 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.1:beta_rc1:*:*:*:*:*:*0.9.1 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.2:beta:*:*:*:*:*:*0.9.2 betaVulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc1:*:*:*:*:*:*0.10.0 beta_rc1VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc2:*:*:*:*:*:*0.10.0 beta_rc2VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc3:*:*:*:*:*:*0.10.0 beta_rc3VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc4:*:*:*:*:*:*0.10.0 beta_rc4VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc5:*:*:*:*:*:*0.10.0 beta_rc5VulnerableLightning Network Daemon Project
cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc6:*:*:*:*:*:*0.10.0 beta_rc6VulnerableLightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5:beta_rc2:*:*:*:*:*:* Versions 0.5 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta:*:*:*:*:*:* Versions 0.5.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc1:*:*:*:*:*:* Versions 0.5.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc2:*:*:*:*:*:* Versions 0.5.1 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc3:*:*:*:*:*:* Versions 0.5.1 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.1:beta_rc4:*:*:*:*:*:* Versions 0.5.1 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.5.2:beta:*:*:*:*:*:* Versions 0.5.2 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta:*:*:*:*:*:* Versions 0.6 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc1:*:*:*:*:*:* Versions 0.6 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc2:*:*:*:*:*:* Versions 0.6 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc3:*:*:*:*:*:* Versions 0.6 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6:beta_rc4:*:*:*:*:*:* Versions 0.6 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta:*:*:*:*:*:* Versions 0.6.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta_rc1:*:*:*:*:*:* Versions 0.6.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.6.1:beta_rc2:*:*:*:*:*:* Versions 0.6.1 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta:*:*:*:*:*:* Versions 0.7.0 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc1:*:*:*:*:*:* Versions 0.7.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc2:*:*:*:*:*:* Versions 0.7.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.0:beta_rc3:*:*:*:*:*:* Versions 0.7.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta:*:*:*:*:*:* Versions 0.7.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta_rc1:*:*:*:*:*:* Versions 0.7.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.7.1:beta_rc2:*:*:*:*:*:* Versions 0.7.1 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta:*:*:*:*:*:* Versions 0.8.0 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc1:*:*:*:*:*:* Versions 0.8.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc2:*:*:*:*:*:* Versions 0.8.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.0:beta_rc3:*:*:*:*:*:* Versions 0.8.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.1:beta:*:*:*:*:*:* Versions 0.8.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta:*:*:*:*:*:* Versions 0.8.2 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta_rc1:*:*:*:*:*:* Versions 0.8.2 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.8.2:beta_rc2:*:*:*:*:*:* Versions 0.8.2 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta:*:*:*:*:*:* Versions 0.9.0 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc1:*:*:*:*:*:* Versions 0.9.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc2:*:*:*:*:*:* Versions 0.9.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc3:*:*:*:*:*:* Versions 0.9.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.0:beta_rc4:*:*:*:*:*:* Versions 0.9.0 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.1:beta:*:*:*:*:*:* Versions 0.9.1 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.1:beta_rc1:*:*:*:*:*:* Versions 0.9.1 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.9.2:beta:*:*:*:*:*:* Versions 0.9.2 beta Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc1:*:*:*:*:*:* Versions 0.10.0 beta_rc1 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc2:*:*:*:*:*:* Versions 0.10.0 beta_rc2 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc3:*:*:*:*:*:* Versions 0.10.0 beta_rc3 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc4:*:*:*:*:*:* Versions 0.10.0 beta_rc4 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc5:*:*:*:*:*:* Versions 0.10.0 beta_rc5 Vulnerable ·Lightning Network Daemon Project
  • cpe:2.3:a:lightning_network_daemon_project:lightning_network_daemon:0.10.0:beta_rc6:*:*:*:*:*:* Versions 0.10.0 beta_rc6 Vulnerable ·Lightning Network Daemon Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26895

References

  • TI-2022-18763 Witness Block Parsing DoS Vulnerability in lnd CVSS 3.1HIGH 8.2
  • TI-2021-18324 Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure. CVSS 3.1HIGH 8.6
  • TI-2020-16323 Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice… CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences