Radicle discloses two critical flaws in its network protocol

Radicle, a peer-to-peer, local-first Git collaboration stack, published a disclosure on 2026-09-23 describing two critical vulnerabilities in the network protocol used by its nodes. Every version of Radicle released to date is affected, and no fix is available yet. The first flaw, reported by Konstantinos Maninakis on 2026-06-24, is a confidentiality problem: traffic between nodes is sent in plain text, so anyone who can observe the network path between two nodes can read the data exchanged. Git's own integrity checks (signed references) still catch tampering, so the core risk is eavesdropping rather than forged content. The second flaw, reported by a researcher known as cryptocode on 2026-08-12, is a broken peer-authentication handshake: an attacker can connect to a node and present a Node ID that is not its own. Because private repositories are shared only with allow-listed Node IDs, an attacker who fakes an allow-listed ID can fetch a private repository directly, even without sitting on the network path, though they first need to learn a valid ID from the non-public allow-list. Radicle says the two flaws are most dangerous combined: an attacker positioned on the network path can observe the Node IDs at both ends of a legitimate connection, read what passes between them, and then reuse one of those IDs to pull the entire repository on demand. Radicle is publishing the disclosure before a security update exists, arguing that users need to be able to act immediately since no later fix can undo data that has already been exposed. It recommends stopping the use of private repositories until a fix ships, and treating any private repository already synced to another node as leaked, rotating any credentials, keys or tokens it contained. Using an additional encrypted transport such as Tor, I2P or a VPN is not enough, the project says, because that hides traffic from an on-path observer but does not stop peer impersonation. To stop serving a repository, Radicle recommends the command rad block rather than rad unseed, since unseed merely removes the seeding policy and falls back to the node's default, which serves the repository again if that default was changed to allow. Radicle lists three limits on what stopping seeding actually achieves: it does not delete the local copy in storage, it does not reach copies already fetched by other authorized peers (who must be asked to block the repository too), and it does not undo exposure that has already happened over the network. Because there is no version-negotiation mechanism and the fix is incompatible on the wire, Radicle says the eventual patch will be a breaking change requiring a major version bump; no release date is given. The planned resolution replaces Radicle's current custom protocol, built on Noise, with iroh, an open-source peer-to-peer networking stack, a migration the project says it had already been planning and which will also bring features such as NAT traversal. The transport change will be backward-incompatible and will split the network into upgraded and non-upgraded clusters that cannot talk to each other, though Radicle says it is trying to keep the storage layout compatible to smooth the upgrade. Radicle states that neither flaw lets an attacker forge code or identities, since Git objects and signed references are still verified at the storage layer as before.

Key facts

• Radicle disclosed two critical network-protocol vulnerabilities on 2026-09-23, affecting all versions released to date, with no fix yet available.
• Flaw one: node-to-node traffic is unencrypted, letting anyone on the network path read data in transit; reported by Konstantinos Maninakis on 2026-06-24.
• Flaw two: the peer-authentication handshake is broken, letting an attacker impersonate an allow-listed Node ID to fetch a private repository; reported by cryptocode on 2026-08-12.
• Radicle recommends stopping use of private repositories until a fix ships, using rad block to stop seeding, and rotating any credentials already transmitted.
• The eventual fix requires a breaking major-version release that replaces Radicle's custom Noise-based protocol with the iroh networking stack.

Why it matters

Radicle is a peer-to-peer, local-first Git platform, and its core promise is that nodes can sync repositories directly with each other without a central server. This disclosure shows that, in every version shipped so far, that node-to-node traffic has never been encrypted or authenticated, and the mechanism meant to restrict private repositories to trusted peers can be defeated by an attacker faking a trusted Node ID.

Who it affects

Anyone running a Radicle node, particularly users seeding or syncing private repositories, since public repositories are described as less exposed to the confidentiality issue.

How to use it

Radicle tells users to stop using private repositories over the network until a fixed version ships, to stop seeding them with rad block (rather than rad unseed, which can fall back to an allow default), to keep the repositories in local storage rather than deleting them so seeding can resume later, and to treat any private repository already synced elsewhere as leaked, rotating any credentials, keys or tokens it held. Running additional encrypted transports like Tor, I2P or a VPN does not fix the impersonation flaw.

How solid is it

This is a first-party disclosure from the Radicle project itself, naming both external reporters and the exact dates they reported the issues, and published deliberately before a patch existed so users could act.

Risks and caveats

No date is given for the fixed, breaking major-version release. Stopping seeding has three limits according to Radicle: it does not delete the local copy already in storage, it does not reach copies other authorized peers already fetched, and it cannot undo exposure that has already occurred over the network.

“We recommend to stop using private repositories until a fix is released.”

— Radicle project, security disclosure