CVE-2026-44359
Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow
Description
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.
INFO
Published Date :
July 20, 2026, 12:16 a.m.
Last Modified :
Oct. 24, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Update Meshtastic to version 2.7.21.1370b23.
- Apply the patch provided in the release.
Public PoC/Exploit Available at Github
CVE-2026-44359 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-44359.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-44359 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-44359
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
End-to-end technical analysis and reproduction notes for high-impact CVEs (e.g., pre-auth RCEs, sandbox escapes, and privilege escalations).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-44359 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-44359 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: firmware de meshtastic, Description: Meshtastic es una solución de red mallada de código abierto. Antes de la versión 2.7.21.1370b23, el flujo de trabajo main_matrix.yml del repositorio de GitHub de Meshtastic se activaba mediante pull_request_target y múltiples trabajos extraían el código del fork del atacante y lo ejecutaban con acceso a los secretos del repositorio y permisos elevados de GITHUB_TOKEN. No existía una puerta de aprobación. Las solicitudes de extracción de usuarios externos con author_association: ’NONE’ activaban automáticamente el flujo de trabajo de CI. El flujo de trabajo ejecutaba directamente archivos controlados por el atacante desde la extracción del fork. Este problema podría haber resultado en un compromiso de la cadena de suministro, un compromiso del runner autoalojado y/o una toma de control del repositorio. Este problema es independiente de GHSA-6mwm-v2vv-pp96, que abordó una inyección de comandos a través de github.head_ref en el trabajo de configuración del mismo flujo de trabajo. Esa corrección se movió correctamente a variables de entorno. Sin embargo, la vulnerabilidad más crítica de extracción del fork en los trabajos de check, build y build-debian-src no fue abordada. La versión 2.7.21.1370b23 contiene un parche para este problema. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 24, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-44359', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-20T19:06:04.914895Z'} {'id': 'CVE-2026-44359', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-23T00:00:00+00:00'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 20, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-44359', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-20T19:06:04.914895Z'} -
New CVE Received by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'meshtastic', 'product': 'firmware', 'versions': [{'status': 'affected', 'version': '< 2.7.21.1370b23'}]}] Added Description Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Added CWE CWE-94 Added CWE CWE-829 Added Reference https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing Added Reference https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5 Added Reference https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96 Added Reference https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736