Radicle discloses cleartext traffic and peer impersonation flaws in every release to date

Radicle, a peer-to-peer, local-first code collaboration stack built on Git, has disclosed two critical vulnerabilities in the network protocol its nodes use to communicate. According to the project's advisory, published 23 September 2026, every version of Radicle released so far is affected, and users are being told to stop using private repositories over the network until a fix ships.

Two flaws in the transport layer

The first issue is that traffic between Radicle nodes travels in cleartext, with no encryption and no channel authentication. Anyone able to observe the network path between two nodes can read the data they exchange. Konstantinos Maninakis reported this to the project on 24 June 2026.

The second issue sits in the connection handshake: peer authentication is broken, so an attacker can connect to a node while presenting a Node ID that is not their own. Private repositories are shared only with allow-listed Node IDs, which means an attacker who fakes an allow-listed ID can fetch a private repository directly, without ever being on the network path. A researcher known as cryptocode reported this on 12 August 2026.

On its own, the impersonation flaw is harder to exploit, since the allow-list is not public and an attacker would have to guess a valid Node ID. But the disclosure warns that the two flaws compound: an on-path attacker can see the Node IDs at both ends of a connection, normally both allow-listed, read whatever is exchanged while they watch, and then reuse a Node ID they observed to pull the entire repository on demand. No setting or allow-list defends against an on-path attacker, Radicle says.

Integrity is not the problem. Both flaws live in the node transport layer, not the repository data model: Git objects and Signed References are still verified at the storage layer, so an attacker cannot forge code or identities. The exposure is confidentiality, meaning information leakage, which matters little for public repositories and a great deal for private ones.

What users should do now

The advisory's guidance is blunt: stop using and seeding private repositories over the network until the security update lands, though copies can stay in storage so they can be reseeded later. Radicle also says every private repository already transmitted to another node should be treated as leaked, and that any credentials, keys or tokens inside them should be rotated.

To stop seeding, the project recommends rad block over rad unseed, because an explicit block is honored regardless of the node's default seeding policy, whereas rad unseed merely falls back to that default. Stopping the node entirely is also an option.

The disclosure flags three limits: blocking does not delete the local copy, it does not reach copies already fetched by authorized peers, whose nodes share the same flaws and should block the repository too, and it cannot undo past exposure. Overlay networks and VPNs such as Tor or I2P are likewise described as insufficient. They hide traffic from an on-path observer but do not stop impersonation, leaving a targeted, sophisticated attack room to exfiltrate private repository contents.

A breaking fix built on iroh

No backward-compatible mitigation exists. Radicle explains that the protocol lacks version negotiation and the fix is incompatible on the wire, so the security release will bump the major version. The plan is to replace Radicle's current custom protocol, which uses Noise, with iroh, an open-source peer-to-peer networking stack built on open standards that also brings extras like NAT traversal.

Because the transport change is inherently incompatible, the network will partition into upgraded and non-upgraded clusters that cannot talk to each other. The team says it is keeping the storage layout compatible and confining the breakage to the network side to smooth the upgrade path. Radicle adds that it published the disclosure before the fix is ready because users can act today, and no future patch can erase exposure that has already occurred. Maninakis and cryptocode were thanked for the responsible reports.

Why it matters

Radicle's pitch is sovereignty: local-first, peer-to-peer collaboration without a central host. This disclosure is a reminder that holding your code on your own machine does not automatically protect it in transit, and that transport encryption and peer authentication are load-bearing components of any peer-to-peer design. The episode also accelerates a migration to iroh that will split the Radicle network in two, illustrating the real cost of shipping protocols without version negotiation. For anyone running private repositories on Radicle today, the practical reading is uncomfortable but clear: assume exposure, rotate secrets, and wait for the major release.