Radicle Discloses Two Critical Flaws: Its P2P Protocol Has No Encryption or Real Auth

Radicle, a Git-based peer-to-peer code collaboration stack, has disclosed two critical vulnerabilities in the network protocol its nodes use to sync — and every version released so far is affected. The first flaw is that node-to-node traffic travels in cleartext, so anyone positioned on the network path can read whatever objects two nodes exchange. The second breaks peer authentication in the connection handshake, letting an attacker present a Node ID that isn’t theirs and impersonate an allow-listed peer to pull a private repository directly. Signed References still protect repository integrity, so attackers can’t forge code or identities, but confidentiality of private repos is not guaranteed.

The two bugs are dangerous in combination. An on-path attacker can observe the Node IDs at both ends of a connection — normally both allow-listed — read the data as it flows, and then reuse one of those IDs to fetch the entire repository on demand. No configuration or allow-list defends against a path-positioned adversary, and overlay networks like Tor, I2P, or a VPN aren’t sufficient because they don’t stop peer impersonation. The team is publishing ahead of a patch specifically because exposure that has already occurred can’t be undone by a later fix.

Until a fixed release ships, maintainers advise stopping all network use of private repositories, blocking their seeding policies (via rad block rather than rad unseed), and treating any private repo already transmitted as leaked — rotating any credentials, keys, or tokens it contained. There’s no backward-compatible mitigation: the fix is wire-incompatible, so it will be a breaking major release. Radicle plans to replace its custom Noise-based protocol with iroh, an open-standards P2P networking stack that also adds NAT traversal, while keeping the storage layout compatible to ease the upgrade. The issues were responsibly disclosed by Konstantinos Maninakis and a researcher going by cryptocode.