CVE-2026-44359
CriticalCVSS 10.0Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
The Meshtastic GitHub repository before version 2.7.21.1370b23 has a vulnerability in the main_matrix.yml workflow triggered by pull_request_target. Multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" automatically triggered CI. The workflow directly executes attacker-controlled files from the fork checkout. This could lead to supply chain compromise, runner compromise, or repository takeover. The fix is in version 2.7.21.1370b23.
Risk Assessment
An attacker could take over the Meshtastic repository, compromise the software supply chain, or access secrets, with critical impact on project security.
Recommendation
Upgrade Meshtastic to version 2.7.21.1370b23 or later immediately, and review CI/CD configuration to prevent automatic workflow execution from external forks.
Other vulnerabilities in Meshtastic
See all- CVE-2026-42566High
In Meshtastic prior to version 2.7.23.b246bcd, a single node advertising a User.long_name with malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The issue arises from accidental null terminator placement in a multibyte sequence during buffer truncation, poisoning the node database.
- CVE-2025-53627Medium
Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct messages, but when the `pki_encrypted` flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an intentional decision to maintain backwards compatibility. However, the end-user applications, like Web app, iOS/Android app, and applications built on top of Meshtastic using the SDK, did not have a way to differentiate between end-to-end encrypted DMs and the legacy DMs. This creates a downgrade attack path where adversaries who know a shared channel key can craft and inject spoofed direct messages that are displayed as if they were PKC encrypted. Users are not given any feedback of whether a direct message was decrypted with PKI or with legacy symmetric encryption, undermining the expected security guarantees of the PKI rollout. Version 2.7.15 fixes this issue.
Original NVD description (English source)
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS