Radicle: Disclosure of Vulnerability in the Network Protocol

Radicle disclosed two critical protocol flaws—plaintext, unauthenticated node traffic and broken peer handshake authentication—affecting every released version, letting on-path attackers read or exfiltrate private repositories; no compatible fix exists, and a…

Radicle, a peer-to-peer Git code collaboration platform, disclosed two critical vulnerabilities in its node network protocol affecting every version released to date. First, traffic between nodes is neither encrypted nor authenticated, so an attacker on the network path can read exchanged objects in transit—although signed references still detect modified repository contents, preventing forged code or identities. Second, the handshake's broken peer authentication lets an attacker present another node's ID and fetch a private repository whose allow-list includes that ID. No backward-compatible mitigation exists; remediation requires a breaking major release that replaces Radicle's custom Noise-based protocol with the iroh network stack. Per earlier reporting on this story, the flaws were reported by Konstantinos Maninakis on June 24 and by cryptocode on August 12. Until the fix ships, users are advised to stop using and seeding private repositories over the network (via 'rad block'), treat all previously synced private data as disclosed, and rotate any exposed credentials, keys, or tokens.

• Two critical vulnerabilities were disclosed in Radicle's peer-to-peer network protocol, and every released version of Radicle is affected; no fix is available yet.
• Node-to-node traffic is unencrypted and unauthenticated, allowing attackers on the network path to read exchanged objects in transit.
• A broken handshake lets attackers impersonate allow-listed Node IDs and fetch private repositories whose allow-lists include those IDs.
• Signed references still prevent forged code or identities, limiting the impact to confidentiality rather than integrity.
• No backward-compatible fix exists; remediation requires a breaking protocol change replacing Radicle's custom Noise-based protocol with the iroh network stack.
• The vulnerabilities were reported by Konstantinos Maninakis on June 24 and by cryptocode on August 12, per earlier reporting on this story.
• Users are advised to stop using and seeding private repositories over the network (via 'rad block'), treat previously synced private data as disclosed, and rotate exposed credentials, keys, or tokens.