Radicle Protocol Vulnerabilities Expose Private Data

• •Two critical vulnerabilities expose private repository data in cleartext.
• •All versions of radicle-node are affected, with no current patch available.
• •Immediate action is recommended to secure communications using VPNs or SSH tunnels.

Radicle has disclosed two critical vulnerabilities in its wire protocol that allow attackers to read private repository data in cleartext and impersonate nodes. The flaws stem from a failure to maintain cipher states after a Noise handshake, resulting in unencrypted communication over TCP sockets. This affects all versions of radicle-node released to date, including the latest 1.10.3. The vulnerabilities were identified by engineer Kostis Maninakis and have prompted recommendations to halt clearnet operations for private repositories. The lack of version negotiation capabilities prevents a backward-compatible fix, necessitating a major architectural overhaul. Users are advised to tunnel connections through secure methods like WireGuard or SSH to mitigate risks. The vulnerabilities have not yet been patched, and a RustSec advisory may follow.