Radicle Discloses Critical Vulnerabilities in Network Protocol Affecting All Versions

Critical Vulnerabilities Identified

Radicle, a peer-to-peer, local-first code collaboration stack, has announced the discovery of two critical security vulnerabilities within its network protocol. These issues impact all versions of Radicle released to date, necessitating immediate user attention.

Unencrypted Traffic and Data Leakage

The first vulnerability, reported by Konstantinos Maninakis, reveals that network traffic between Radicle nodes is neither encrypted nor authenticated. This means that anyone observing the network path can read data exchanged in plain text. While less critical for public repositories, this poses a significant information leakage risk for private repositories, where encryption in transit is essential.

Broken Peer Authentication and Impersonation

The second flaw, reported by cryptocode, concerns broken peer authentication during the connection handshake, allowing node impersonation. An attacker can present a fake Node ID to fetch private repositories directly if they know an allow-listed Node ID. Although harder to exploit without knowing a valid Node ID, this vulnerability bypasses access controls for private data.

User Recommendations and Upcoming Fix

Radicle recommends that users cease using private repositories until a fix is released. Due to the nature of the fix and the lack of version negotiation features, the upcoming resolution will be a breaking change, resulting in a major version bump. The development team is actively working on this resolution and aims to provide transparency to users as they address the situation.