CVE-2020-26895: Lightning Network Daemon Project Lightning Network Daemon

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations.

Affected products

• Lightning Network Daemon Project Lightning Network Daemon: version 0.1 only; version 0.1.1 only; version 0.2 only; version 0.2.1 only; version 0.3 only; version 0.4 only; …

Published 2020-10-21. Last modified 2026-06-17.