Code Execution Vulnerability in Meshtastic Open Source Networking Solution
CVE-2026-44359

10CRITICAL

Key Information:

Vendor

Meshtastic

Status
Firmware
Vendor
CVE Published:
19 July 2026

What is CVE-2026-44359?

The Meshtastic firmware is subject to a code execution vulnerability due to its GitHub repository's workflow configuration. Prior to version 2.7.21.1370b23, the main_matrix.yml workflow was initiated by pull_request_target events without appropriate security safeguards. This allowed unauthorized users' code from their GitHub forks to be executed with elevated repository permissions, potentially leading to supply chain attacks, compromises of self-hosted runners, and repository takeovers. These risks arise from the automatic triggering of CI workflows by pull requests from external contributors without necessary approval, exposing sensitive repository secrets. A patch has been implemented in version 2.7.21.1370b23 to address this critical issue.

Affected Version(s)

firmware < 2.7.21.1370b23

References

https://github.com/meshtastic/firmware/security/advisorie...
x_refsource_CONFIRM
https://github.com/meshtastic/firmware/security/advisorie...
x_refsource_MISC
https://github.com/meshtastic/firmware/commit/5716aeba3bc...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.