GoKawiilRadicle discloses two critical flaws in its peer-to-peer network protocol
Radicle disclosed two critical security vulnerabilities affecting every released version of its code collaboration stack: network traffic between nodes is unencrypted and can be read by anyone observing the path, and the connection handshake's peer authentication can be bypassed. Security researcher Konstantinos Maninakis reported the encryption issue on June 24, 2026, prompting the disclosure.
GoKawiil's interpretation of the reporting above, not reported fact.
Because content integrity is still checked via Signed References, attackers cannot easily tamper with data, but they can eavesdrop on it, which the project says makes private repositories especially risky until a fix ships. Radicle says the fix requires a breaking, major-version change since there's no way to negotiate protocol versions backward-compatibly, meaning affected users may face disruption when upgrading. In the meantime, the project is urging users to stop hosting private repos as a precaution.
- All released Radicle versions are vulnerable to unencrypted, unauthenticated network traffic between nodes.
- Public repositories are less at risk, but private repositories face real information-leakage exposure.
- A true fix requires a breaking major-version release, since no backward-compatible mitigation is possible.
Source: radicle.dev, 2026-09-23
Published there as: “Radicle: Disclosure of Vulnerability in the Network Protocol”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.