Radicle: Disclosure of Vulnerability in the Network Protocol
Radicle disclosed unencrypted node traffic and broken peer authentication affecting every released version.
Radicle, a peer-to-peer Git collaboration stack, disclosed two critical protocol flaws present in every version released to date. Traffic between nodes is neither encrypted nor authenticated, so anyone on the network path can read objects in transit, although signed references still detect modified repository contents. A broken handshake also lets an attacker present another node's ID and fetch a private repository that allow-lists that ID. No compatible mitigation exists; a breaking release that replaces the custom Noise protocol with iroh is underway, and users are told to stop seeding private repositories and treat previously synced private data as disclosed.
- Node traffic is plaintext, so on-path attackers can read exchanged objects.
- A broken handshake lets attackers impersonate allow-listed Node IDs.
- Every released Radicle version is affected and no fix is available yet.
- Stop seeding private repositories and rotate any exposed credentials.
- Signed references still prevent forged code or identities.
From the original article
5 min read at radicle.dev
Two critical security vulnerabilities in the network protocol used by Radicle nodes were reported. All versions of Radicle that were released to date are vulnerable. Network traffic between nodes is not encrypted and not authenticated.
By lostmsu · radicle.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.