Radicle is a peer-to-peer, local-first code collaboration stack built on Git, and it just published two critical vulnerabilities in the network protocol its nodes speak. Every version released to date is affected. The team is shipping the disclosure ahead of the fix on purpose: no later patch can undo an exposure that already happened.

The two flaws:

  • Node-to-node traffic is neither encrypted nor authenticated — anyone able to observe the path between two nodes reads whatever they exchange, in plain text (reported 2026-06-24 by Konstantinos Maninakis)
  • Peer authentication in the handshake is broken, so an attacker can present a Node ID that is not theirs; since private repositories are shared by allow-listing Node IDs, a faked allow-listed ID can fetch a private repository directly, without sitting on the path at all (reported 2026-08-12 by cryptocode)
  • Alone, the impersonation flaw is hard — you have to know an allow-listed Node ID, and the allow-list is not public. Together they compound: a path attacker sees the Node IDs at both ends, both normally allow-listed, reads everything while watching, then uses a Node ID they observed to pull whole repositories on demand
  • Integrity was never the problem. Git objects and signed references still verify at the storage layer, so nobody can forge code or identities — the failure is confidentiality

What they tell users to do now:

  • Stop seeding private repositories over the network; rad ls --private --all lists them, rad block <RID> stops serving them
  • rad block is preferred over rad unseed, because unseed only removes the policy and a node whose default is allow keeps serving
  • Treat every private repository ever transmitted as leaked, and rotate any credentials, keys, or tokens inside
  • Overlays like Tor, I2P, or a VPN do not fix it — they hide traffic from a path attacker but do nothing about impersonation
  • Blocking stops serving; it does not delete local copies, does not reach copies peers already fetched, and does not undo past exposure
  • The fix is unavoidably breaking: with no version negotiation and a wire-incompatible change, it needs a major version, replacing the custom Noise-based protocol with iroh while keeping the storage layout compatible so the breakage stays on the network end

Two things stand out. First, the honest scoping — the disclosure states plainly that the workaround is partial and that network overlays do not help, which is the opposite of the usual “no action required” framing. Second, the failure class: a transport everyone assumed was confidential because the design intended it to be, with no mechanism enforcing the assumption.

Publishing before the patch is the right call here and worth copying. The users who can act need to know now; the users who cannot act lose nothing by knowing early.