{
  "id": 9360276,
  "title": "Radicle: Disclosure of Vulnerability in the Network Protocol",
  "url": "https://urgent.news/2026/09/23/radicle-disclosure-of-vulnerability-in-the-network-protocol",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-23T14:34:37.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol.html"
  },
  "original_language": "en",
  "account": "Critical security issues have been discovered in Radicle, a peer-to-peer, local-first code collaboration platform built on Git. Both vulnerabilities affect all versions of Radicle released to date and involve the network protocol used by Radicle nodes. The first flaw is that network traffic between nodes is not encrypted or authenticated, meaning an attacker along the network path can read objects in transit. While the impact is less concerning for public repositories, it is more significant for private repositories. The second flaw is harder to exploit but becomes more dangerous when combined with the first flaw. An attacker would need to impersonate an allow-listed Node ID, which is typically only known by someone on the network path. This would allow the attacker to read exchanged data and fetch the entire repository on demand. The vulnerabilities are in the node transport layer, not the repository data model. Git objects and signed references remain verified at the storage layer. A major update is necessary to replace Radicle's custom networking protocol with iroh, an open-source peer-to-peer networking stack. This update will cause the network to partition into upgraded and non-upgraded clusters, which cannot communicate with each other. The security update will be a breaking change, requiring users to migrate to the new major version. Radicle appreciates the responsible disclosure by Konstantinos Maninakis and cryptocode, and encourages users to report any security concerns through their security page.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "LWN",
        "title": "Critical security vulnerabilities in the Radicle network protocol",
        "url": "https://urgent.news/2026/09/23/critical-security-vulnerabilities-in-the-radicle-network-protocol",
        "published": "2026-09-23T14:20:46.000Z"
      },
      {
        "outlet": "Hacker News",
        "title": "Radicle: Disclosure of Vulnerability in the Network Protocol",
        "url": "https://urgent.news/2026/09/23/radicle-disclosure-of-vulnerability-in-the-network-protocol",
        "published": "2026-09-23T15:23:05.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}