Radicle Discloses Two Flaws, Neither Has a Patch

Radicle, a peer-to-peer, local-first code-hosting tool built on Git, disclosed Wednesday that its network protocol has never encrypted traffic between nodes, and that a second, separate flaw lets an attacker impersonate a trusted peer to pull a private repository without ever sitting on the network path.

The disclosure, posted to Radicle's own blog, says every version released to date is affected and that no fixed release exists yet. A parallel writeup from Kostis Maninakis, the researcher who reported the first flaw, adds a detail the official post does not: the plaintext starts at byte 32 of the connection, the first byte after the handshake completes.

Two reports, two months apart

Every Radicle connection opens with a Noise handshake, the same handshake family WireGuard uses, which proves the peer on the other end holds the private key it claims to hold. What happens after that handshake is where both flaws sit.

Maninakis reported the first flaw on June 24, 2026: everything exchanged after the handshake, gossip, repository IDs, node addresses and Git objects, travels over a plain TCP socket unencrypted. He found it by accident, building a Radicle node meant to run inside a browser tab; his own implementation encrypted the channel correctly, and no real Radicle node on the network could understand it.

A second researcher using the handle cryptocode reported a separate flaw on Aug. 12, 2026: the connection handshake can be tricked into accepting a Node ID an attacker does not control. Private repositories are shared only with node IDs on an allow list, and impersonating one on that list lets an attacker fetch a private repository directly, with no need to sit on the network path between two real nodes.

Date	Event
June 24, 2026	Maninakis reports the cleartext transport flaw
Aug. 12, 2026	cryptocode reports the peer-impersonation flaw
Sept. 23, 2026	Radicle and Maninakis publish coordinated writeups

Why the two flaws are worse together

Alone, the impersonation flaw is hard to use: Radicle's allow list is not public, so an attacker off the path has to guess a valid Node ID. Combined with the cleartext flaw, that barrier disappears. An attacker who can watch a connection, an internet provider, a transit provider, a relay, sees the Node IDs at both ends, since those travel unencrypted too, then uses one to fetch the whole repository later, on demand, from anywhere.

Both flaws sit in Radicle's transport layer rather than its data model. Git objects and signed references are still checked at the storage layer, Radicle's post says, so neither flaw lets an attacker forge code or alter what a repository contains, only read it, or read what others send and receive over it.

No CVE, and no patch date

Neither Radicle's post nor Maninakis's carries a CVE number. Maninakis writes that "a RustSec advisory may follow." Radicle says the fix cannot ship as a compatible patch: adding real encryption changes the wire format, so it has to ship as a major version bump, and old and new nodes will not be able to talk to each other once it does. Radicle names the replacement as iroh, an open-source peer-to-peer networking stack; Maninakis, describing the same unreleased version, calls it a move to QUIC and TLS. Neither post gives a ship date.

Skipping a CVE number is not unique to Radicle this month: Rust's Miri interpreter leaked CI secrets without one, disclosed before a permanent fix was fully rolled out. Self-hosted git tools have had more than one bad stretch, too: Forgejo patched a 9.9-severity remote-code-execution flaw in its own template repositories.

What to do before a fix ships

Radicle's advisory tells users to:

• Stop using private repositories over the network until a fixed release ships, by running rad block <RID> on each one rather than relying on the node's default seeding policy.
• Treat every private repository already fetched over the network as exposed, and rotate any password, token or key it contained.

Maninakis adds narrower advice for teams running their own seed: tunneling the hop between a laptop and that seed inside WireGuard, a VPN or an SSH tunnel protects it today. He is specific about what does not work, too. Pointing Radicle's global node.proxy setting at Tor sends clearnet traffic out through a Tor exit node, still readable by the exit operator, and does nothing for the impersonation flaw either way.

Radicle has not published a target date for the version that replaces the transport. Until it ships, both advisories agree on the same instruction: any private repository that has already crossed the network should be treated as disclosed, whether or not a fix ever settles who read it.