Radicle discloses two critical vulnerabilities in network protocol

Radicle has disclosed two critical vulnerabilities in its network protocol that affects all released versions. The first flaw allows anyone observing network traffic to access unencrypted data, posing a risk of information leakage. The second flaw permits impersonation of nodes, allowing unauthorized access to private repositories if an attacker has knowledge of an allow-listed Node ID.

The recommended immediate action for users is to stop using private repositories over the network, as the vulnerabilities could lead to severe data exposure. Users are advised to rotate any sensitive credentials or tokens found in these repositories, as they cannot guarantee the confidentiality of the data exchanged after the vulnerabilities were known.

Due to the nature of the vulnerabilities, a major version update will be necessary to implement a fix, as the required changes are not backward compatible. This means that users will need to prepare for a breaking change when the fix is released, which could impact workflows and require adjustments to existing setups.

While alternative encrypted transport methods like Tor or VPNs can obscure traffic from attackers, they do not address the core issues of node impersonation. Therefore, users should be aware that even with these measures, their data may still be at risk until Radicle successfully addresses and resolves these vulnerabilities.

In the interim, users should take proactive measures such as blocking the seeding of private repositories to prevent unauthorized access. This can be done by using specific commands within the Radicle CLI to ensure that private data remains secure until the vulnerabilities are resolved.