Radicle: Disclosure of Vulnerability in the Network Protocol
Radicle disclosed unencrypted node traffic and broken peer authentication affecting every released version.
Radicle, a peer-to-peer Git collaboration stack, disclosed two critical protocol flaws present in every version released to date. Traffic between nodes is neither encrypted nor authenticated, so anyone on the network path can read objects in transit, although signed references still detect modified repository contents. A broken handshake also lets an attacker present another node's ID and fetch a private repository that allow-lists that ID. No compatible mitigation exists; a breaking release that replaces the custom Noise protocol with iroh is underway, and users are told to stop seeding private repositories and treat previously synced private data as disclosed.