CVE-2026-19741: Zephyr OpenThread hardcoded default joiner credential

CVE-2026-19741 · Severity: high · CVSS 7.5 · Published 2026-10-23

Zephyr's OpenThread integration shipped with a publicly known default joining credential ("J01NME") compiled into firmware when autostart was enabled. An attacker within radio range of an uncommissioned Thread device can use this credential to complete a fake commissioning handshake, inject a malicious network configuration, and hijack the device onto an attacker-controlled mesh network, intercepting and spoofing all traffic.

Technologies: Zephyr Project Zephyr. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19741 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19741 being exploited in the wild.
How severe is CVE-2026-19741?
High severity, with a CVSS score of 7.5, published 23 October 2026.
Which products and versions are affected?
Zephyr Project Zephyr Versions where CONFIG_OPENTHREAD_JOINER_AUTOSTART is enabled without a custom PSKd.
Is there a fix for CVE-2026-19741?
Yes: fixed in Fix removes default from CONFIG_OPENTHREAD_JOINER_PSKD and adds BUILD_ASSERT() requiring 6-to-32-character PSKd when joiner autostart is enabled. Until then: Do not enable CONFIG_OPENTHREAD_JOINTER_AUTOSTART, or provision a strong per-device PSKd from factory data and call otJoinerStart() from the application layer instead of relying on compiled-in credentials.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19741 attacked?
It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-19741?
Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Fix removes default from CONFIG_OPENTHREAD_JOINER_PSKD and adds BUILD_ASSERT() requiring 6-to-32-character PSKd when joiner autostart is enabled

Do not enable CONFIG_OPENTHREAD_JOINTER_AUTOSTART, or provision a strong per-device PSKd from factory data and call otJoinerStart() from the application layer instead of relying on compiled-in credentials.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}]

Technical details

CONFIG_OPENTHREAD_JOINER_PSKD defaulted to the well-documented example value "J01NME" used in public OpenThread samples. When CONFIG_OPENTHREAD_JOINER_AUTOSTART is enabled, ot_configure_instance() calls otJoinerStart() with this credential, allowing unauthenticated attackers within 802.15.4 range to complete a DTLS-PSK handshake and provision a device with an attacker-controlled operational dataset. The vulnerability is limited to builds with both options enabled and the PSKd left uncustomized; affected devices remain compromised until factory reset.

Affected products

  • Zephyr Project Zephyr Versions where CONFIG_OPENTHREAD_JOINER_AUTOSTART is enabled without a custom PSKd

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.