Radicle's network protocol leaks private repos in plain text, and a broken handshake lets attackers impersonate trusted nodes
Radicle: Disclosure of Vulnerability in the Network Protocol
Radicle disclosed two critical flaws in its node network protocol: traffic is unencrypted and unauthenticated, so anyone on the network path can read data in transit, and a broken handshake allows Node ID impersonation to fetch private repos. All released versions are affected. Users should stop seeding private repositories over the network and treat any transmitted private repo as leaked. A fix will be a breaking major release replacing the custom Noise-based protocol with iroh.
The realistic threat is anyone on the path between your node and node it syncs with, and no setting or allow-list protects against them.
- Aurornis
> What is the issue?
> Network traffic between nodes is not encrypted and not authenticated.
Oh.
After all of the work they put into using cryptographic identities and decentralization tricks, how did they forget to do anything about the network traffic?
Was this a case of thinking they'd handle it later, but then it fell off the TODO list?
- john_strinlai
>This was reported to us by Konstantinos Maninakis on 2026-06-24.
announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
- sondr3
The fact that this was reported three months ago and the "workaround" is to stop using private repos and assume they are all pwnd is quite something. How do you not notice that cross-node traffic is not encrypted when building something like this?
- skullone
This whole project reads like amateur hour. Still using curl pipe to shell install and everything. Plus this lax security disclosure with just an outstandingly foolish security flaw. Gross.
- iamnothere
Glad to hear they are moving to iroh instead of a custom protocol. This is the problem with rolling your own stuff.
As a bonus, this should help camouflage the traffic. (Iroh is becoming more common.)