Radicle Discloses Critical Flaws Exposing Private Repositories in Plain Text

Radicle disclosed two critical flaws in its wire protocol: radicle-node discards Noise handshake keys and sends Git packs over TCP in cleartext, while spoofed Node IDs let attackers impersonate allow-listed peers. With no backward-compatible fix possible, private clearnet repositories should be treated as compromised until the Iroh-based release ships.

• radicle-node drops Noise session keys and sends Git packs unencrypted over TCP
• Spoofed allow-listed Node IDs let attackers pull private repos from seed nodes
• No backward-compatible patch: handshake frames lack protocol version negotiation
• Until Iroh (QUIC/TLS) ships, use WireGuard, Tor onion services or I2P only