Radicle Says Its Network Leaks Private Repos in Plain Text

An attacker positioned on the network path between two Radicle nodes can read the private repositories they exchange, because the protocol sends that data in plain text rather than encrypting it as intended, Radicle said Sept. 23. A second, separate flaw lets that same class of attacker impersonate a trusted peer to fetch a private repository directly.

Both vulnerabilities affect every version of Radicle released to date, and neither has a patched release yet. Radicle is a decentralized alternative to GitHub built on top of Git, where nodes exchange repository data over a peer-to-peer network rather than a central server.

What the two flaws actually allow

The first flaw is a confidentiality failure: the network protocol "does not give the confidentiality it was expected to give," in Radicle's own words, because data between nodes is sent unencrypted. Software developer Konstantinos Maninakis reported it on June 24, 2026, while building a browser-based Radicle client, according to RuntimeWire.

The second flaw breaks peer authentication in the connection handshake. Private repositories are shared only with allow-listed Node IDs, but an attacker can connect and present a Node ID that is not its own. A researcher using the handle cryptocode reported it on Aug. 12, 2026.

Radicle's own post narrows the second flaw's practical risk: to impersonate an allow-listed Node ID, an attacker has to know one first, and the allow-list itself is not public. An attacker without network-path access has to guess. Combined with the first flaw, though, an on-path observer can learn valid Node IDs by watching traffic, then use them to fetch repositories directly.

Flaw	Reported	Status as of Sept. 24
Cleartext network traffic	June 24, 2026, by Konstantinos Maninakis	No patched version; workaround only
Node ID impersonation	Aug. 12, 2026, by a researcher using the handle cryptocode	Fix proposed upstream, not yet merged

Why Radicle disclosed before a fix existed

Radicle published the disclosure without a patched version to point users to, an unusual sequencing for a coordinated-disclosure post. "We are publishing this before the security update is available," the company wrote. "You can act on it today, and no fix we release later can undo an exposure that has already happened."

The recommended workaround is to stop seeding private repositories: set each private repository's seeding policy to "block" with the rad block command, or stop the node entirely. Radicle's post is explicit that this only prevents further exposure. Data already synced over the network should be treated as disclosed, and any credentials or tokens stored inside an already-shared private repository should be rotated.

RuntimeWire reported the network carried roughly 8,000 repositories across public seed nodes and about 600 weekly active nodes as of April 2026, a scale Radicle's own post does not repeat.

The fix requires a breaking network upgrade

Radicle's resolution is to replace its custom, Noise-based transport with iroh, an open-source peer-to-peer networking stack. The company said it had already planned that migration before the vulnerabilities surfaced, and the reports accelerated it. Because the transport change is backwards-incompatible, it will split the network into upgraded and non-upgraded clusters that cannot talk to each other until every node moves over.

Radicle did not say when the iroh-based release will ship. Both flaws sit in the network transport layer rather than the repository data model, so Git objects and signed references are still verified at the storage layer; an attacker who exploits either bug can read private data but cannot forge code or identities. Two other unpatched-vulnerability disclosures this month followed a similar shape: OpenPLC Runtime's session-hijack flaw shipped with no fix at all, and a revived FoxPro project inherited a 20-year-old security hole it has not yet closed either.