Radicle disclosed two critical network protocol vulnerabilities affecting every released version. A 2026-09-23 summary says traffic between nodes is sent in plaintext, allowing anyone on the network path to read exchanged data. Signed References can detect repository-object tampering, but do not prevent information leakage. Public repositories are less exposed, while private repositories require encryption in transit.

Konstantinos Maninakis reported the unencrypted transport flaw on 2026-06-24. The peer-authentication handshake is also broken, allowing an attacker to present another Node ID. Because private repositories use allow-listed Node IDs, an attacker who learns one can impersonate its owner and fetch a private repository directly.

Radicle recommends stopping use and seeding of private repositories until the update is released. Keep private repositories in storage, but treat every private repository transmitted over the network as leaked. Rotate any credentials, keys, or tokens that were included. Tor, I2P, overlay networks, and VPN solutions do not prevent peer impersonation.

A fixed release will be breaking and will bump the major version number. Version negotiation is lacking, and the wire-incompatible fix makes a backward-compatible mitigation infeasible. Work on the update is under way.