CVE-2026-44359
Received Received - Intake

Meshtastic GitHub Workflow Supply Chain Flaw

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-20
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44359

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
meshtastic meshtastic to 2.7.21.1370b23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Meshtastic's GitHub workflow allows an attacker to execute malicious code via pull requests from untrusted forks. The workflow automatically runs attacker-controlled files with elevated permissions, potentially leading to supply chain compromise or repository takeover.

Detection Guidance

This vulnerability is specific to the Meshtastic GitHub repository's CI/CD workflow and does not directly affect network or system detection. It involves malicious pull requests triggering workflows that execute attacker-controlled code. Monitoring GitHub Actions logs for unauthorized workflow runs or unexpected secrets exposure may help detect exploitation attempts.

Impact Analysis

If exploited, this flaw could allow attackers to steal repository secrets, compromise self-hosted runners, or inject malicious code into releases. Users relying on Meshtastic's software may unknowingly use compromised versions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. Organizations using compromised Meshtastic versions risk non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade Meshtastic to version 2.7.21.1370b23 or later to apply the patch. Review GitHub Actions workflows for similar vulnerabilities, especially those using pull_request_target with untrusted forks. Restrict GITHUB_TOKEN permissions and require manual approval for external pull requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart