← Sunday, September 27, 2026SecurityVulnerability

Radicle protocol flaws expose traffic and let attackers impersonate peers

lwn.net by jzb Editor score 7/10

Radicle’s protocol lacks expected confidentiality and has broken peer authentication, allowing an on-path attacker to read traffic and impersonate an allowed node to fetch private repositories. The flaws show why peer allow-lists do not protect against compromised network paths.

What

Two critical flaws in Radicle’s network protocol expose traffic and break peer authentication.

How

On-path observers can read exchanges, spoof a Node ID, and use an observed ID to fetch a private repository.

Why it matters

Allow-lists do not protect against on-path attackers, and a later fix cannot undo data already exposed.

Read on lwn.net →

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.