Radicle: Disclosure of Vulnerability in the Network Protocol

Radicle is a peer-to-peer, local-first code collaboration stack built on Git.

Summary

What happened?

Two crucial safety vulnerabilities in the network protocol used by Radicle nodes were reported.

Which versions are affected?

All versions of Radicle that were released to date are vulnerable.

What is the issue?

Network traffic between nodes is not encrypted and not authenticated. Authentication of repository contents via Signed References motionless detects if attackers alongside the network way between two nodes modify objects in transit. Thus, the chief involvement is data leakage, i.e., attackers alongside the network way between two nodes reading objects in transit. For community repositories, data leakage is small of a concern. However, encryption in transit is crucial for personal repositories.

What should users do?

We propose to halt using personal repositories until a fix is released.

When volition the fixed type be released?

Due to a deficiency of type negotiation features, blended alongside the fix being incompatible on the wire, a backward compatible mitigation is not feasible; that method the publish to fix this matter volition be breaking, thus bump the important type number. Work towards this is under way. With this disclosure, our goal is, archetypal and foremost, to be honest and apparent concerning the situation, so that users can measure and act accordingly, during we are operating on a resolution.

The vulnerabilities

1. The network protocol used by Radicle does not provision the confidentiality it was expected to give. Anyone who can detect the network way between two nodes can peruse the data they toggle as the data is sent in plain text. This was reported to us by Konstantinos Maninakis on 2026-06-24. You can peruse his article concerning the matter at https://maninak.com/blog/radicle-cleartext-transport-vulnerability/. We reported upstream, see this issue.
2. Peer authentication in the association handshake is damaged and allows impersonation. An attacker can nexus to your node and current a Node ID that is not its own. Private repositories are shared lone alongside allow-listed Node IDs. An attacker who fakes an allow-listed Node ID can fetch a personal repository directly, without being on the network path. This was reported to us by cryptocode on 2026-08-12. We projected a fix upstream, see this drag request.

The second flaw is harder to utilize on its own than it sounds. To impersonate an allow-listed Node ID, an attacker must archetypal cognize one. The allow-list is not public, so an attacker who is not on the network way has to guess.

In practice, the two flaws are most helpful whenever they can be exploited together: an attacker on the way sees the Node IDs at the two ends of a connection, and the two are normally on the allow-list. That attacker can peruse any is exchanged during they watch, and can afterward use a Node ID they saw to fetch the entire repository on demand. The realistic danger is anyone on the way between your node and node it syncs with, and no environment or allow-list protects against them.

We are publishing this before the safety update is available. You can act on it today, and no fix we publish afterward can undo an visibility that has already happened.

Workaround

• Stop using personal repositories (over the network) until the safety update is released. Stop seeding personal repositories, as described below. However, you may desire to keep your personal repositories in storage, i.e., not delete them entirely, so that you may commencement seeding them again formerly a fixed type is released.
• Consider all personal repository you have transmitted complete the network to another node leaked. If it contained unencrypted credentials, keys, or tokens, rotate them.
• Using additionally encrypted transports, specified as Tor, I2P, or another overlay networks or VPN solutions are not adequate to defend your data. They conceal network traffic from an attacker alongside the network way between two nodes. Even although that limits the assault surface, this does not forestall equal impersonation, and a targeted, advanced assault power guide to exfiltratation of the contents of personal repositories.

How to halt seeding personal repositories

List the personal repositories in storage:

Change the seeding guideline of extremely idiosyncratic repository to “block”:

Note: We propose to use rad obstacle alternatively of rad unseed, in case the seeding guideline of your node is set to allow.

rad unseed removes the seeding guideline for a repository, and your node afterward falls rear to its default policy. The default is block, so on a default configuration rad unseed is enough. If you changed the default seeding guideline to allow, your node keeps serving the repository following you unseed it. rad obstacle sets an definitive block, which the node checks first, so it plant either way.

To halt the node completely:

Three limits on what this achieves:

• It stops your node from serving the repository. It does not delete your local copy. The copy stays in $(rad path)/storage/<RID without the rad: prefix>. Remove that directory lone if you comprehend you are deleting the repository and all fork of it that you hold. If in doubt, do not delete from storage.
• It does not attain copies that authorized peers already fetched. Those peers motionless clasp the data, and their nodes have the identical flaws. Ask them to obstacle the repository too.
• It does not undo former exposure. Data that has already synced complete the network have to be treated as disclosed.

What is affected

Both flaws are in the node transport layer, not in the repository data model. Git objects and signed references are verified at the retention tier as before. An attacker cannot forge code or identities.

The confidentiality flaw has been current in all Radicle type released to date.

Resolution

We are actively operating on a resolution.

The resolution involves replacing Radicle’s networking protocol (currently a tradition protocol using Noise) alongside iroh, an open origin peer-to-peer networking stack built on open standards. We already shared out plans to migrate, and the vulnerabilities have stated us all the additional logic to move onward alongside this. Beyond addressing the vulnerabilities, iroh brings additional features akin NAT traversal which enhance the reliability and resilience of the Radicle network.

Such a alter to the network transport is by its nature backwards-incompatible. As such, it causes the network to partition into the upgraded and non-upgraded clusters that can not communicate alongside all other.

Even although this method a important release, we are operating to create the upgrade way as gentle as possible, by focusing breakage on the network end, keeping retention layout compatible.

Acknowledgements

We would akin to appreciate Konstantinos Maninakis and cryptocode for responsibly disclosing these vulnerabilities to us and staying in touch.

If you would akin to study a safety issue, delight mention to https://radicle.dev/.well-known/security.txt.