Radicle网络协议披露两项严重安全漏洞

基于Git的点对点代码协作平台Radicle公布了其网络协议中存在的两项严重安全漏洞1。其中，网络流量既未进行加密也未进行认证，同时对等节点的认证机制存在破损，允许攻击者冒充允许列表中的节点1。

Radicle官方确认所有已发布版本均受该漏洞影响1。首个漏洞由Konstantinos Maninakis于2026年6月24日报告，第二个漏洞由cryptocode于2026年8月12日报告，漏洞信息于2026年9月23日正式披露1。攻击者可利用这些漏洞读取私有仓库中的数据或冒充节点进行恶意操作1。为应对安全威胁，官方建议用户停止使用私有仓库，直至安全更新发布1。

修复方案涉及用开源的iroh网络协议栈替换现有的自定义Noise协议1。由于修复工作需要进行主版本号升级，因此无法提供向后兼容的解决方案1。

Radicle, a peer-to-peer code collaboration platform built on Git, has disclosed two serious security vulnerabilities in its network protocol affecting all released versions of the software 1. The vulnerabilities stem from unencrypted and unauthenticated network traffic and broken peer authentication mechanisms that allow attackers to impersonate nodes 1. These flaws create two distinct attack vectors: adversaries can read private repository data by intercepting communications, or they can masquerade as nodes on the allowlist to gain unauthorized access 1.

The first vulnerability was reported by Konstantinos Maninakis on June 24, 2026, followed by a second report from cryptocode on August 12, 2026, with the full disclosure published on September 23, 2026 1. Radicle's development team has advised users to cease using private repositories until a security update is released 1. The fix will require replacing the custom Noise protocol implementation with an open-source iroh network stack, necessitating a major version upgrade that will break backward compatibility 1.