# Radicle Network Protocol Vulnerability

> Radicle's network protocol leaks private repositories without encryption.
- Title: Radicle Network Protocol Vulnerability · Radicle | Shortify
- Summary: Radicle's network protocol leaks private repositories without encryption. Radicle's network protocol exposes private repositories to attackers via…
- Keywords: radicle, network protocol, private repositories, security vulnerability, encryption, authentication, signed references, node id, peer-to-peer, git, technology, startups
- Source: Radicle — https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol
- Read time: 1 min
- Topics: radicle, network protocol, private repositories, security vulnerability, encryption, authentication, signed references, node id, peer-to-peer, git, technology, startups
## What happened?
Two critical security vulnerabilities in Radicle's network protocol were reported.
## Affected versions
All versions of Radicle released to date are vulnerable to the issues.
## What is the issue?
Network traffic between nodes is not encrypted and not authenticated, risking information leakage.
## Public vs private repositories
Information leakage is less concerning for public repositories but critical for private repositories.
## User recommendations
Stop using private repositories until a security update is released to prevent leaks.
## Fix timeline
The fix requires a major version update due to incompatibility with existing network protocols.
## Vulnerability details
Peer authentication is broken, allowing attackers to impersonate nodes and access private repositories.
## Realistic threat
Attackers on the network path between nodes can read data and fetch private repositories without detection.
## Workaround steps
Block private repositories using rad block to prevent seeding until the security update is available.
## Key takeaway

Radicle's network protocol exposes private repositories to attackers via unencrypted traffic and broken authentication, requiring immediate stop of private repository usage until a security update.