# CVE-2026-19741: Zephyr OpenThread hardcoded default joiner credential

Source: https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-19741 · Severity: high · CVSS 7.5 · Published 2026-10-23

Zephyr's OpenThread integration shipped with a publicly known default joining credential ("J01NME") compiled into firmware when autostart was enabled. An attacker within radio range of an uncommissioned Thread device can use this credential to complete a fake commissioning handshake, inject a malicious network configuration, and hijack the device onto an attacker-controlled mesh network, intercepting and spoofing all traffic.

Technologies: [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-19741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19741 being exploited in the wild.

**How severe is CVE-2026-19741?** High severity, with a CVSS score of 7.5, published 23 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr Versions where CONFIG_OPENTHREAD_JOINER_AUTOSTART is enabled without a custom PSKd.

**Is there a fix for CVE-2026-19741?** Yes: fixed in Fix removes default from CONFIG_OPENTHREAD_JOINER_PSKD and adds BUILD_ASSERT() requiring 6-to-32-character PSKd when joiner autostart is enabled. Until then: Do not enable CONFIG_OPENTHREAD_JOINTER_AUTOSTART, or provision a strong per-device PSKd from factory data and call otJoinerStart() from the application layer instead of relying on compiled-in credentials.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19741 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-19741?** Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fix removes default from CONFIG_OPENTHREAD_JOINER_PSKD and adds BUILD_ASSERT() requiring 6-to-32-character PSKd when joiner autostart is enabled

Do not enable CONFIG_OPENTHREAD_JOINTER_AUTOSTART, or provision a strong per-device PSKd from factory data and call otJoinerStart() from the application layer instead of relying on compiled-in credentials.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-23"}]

## Technical details

CONFIG_OPENTHREAD_JOINER_PSKD defaulted to the well-documented example value "J01NME" used in public OpenThread samples. When CONFIG_OPENTHREAD_JOINER_AUTOSTART is enabled, ot_configure_instance() calls otJoinerStart() with this credential, allowing unauthenticated attackers within 802.15.4 range to complete a DTLS-PSK handshake and provision a device with an attacker-controlled operational dataset. The vulnerability is limited to builds with both options enabled and the PSKd left uncustomized; affected devices remain compromised until factory reset.

## Affected products

- Zephyr Project Zephyr Versions where CONFIG_OPENTHREAD_JOINER_AUTOSTART is enabled without a custom PSKd

## Related threats

- [Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api)
- [Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port)
- [Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection)
- [Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids)
- [Zephyr kernel integer overflow in dynamic object allocation](https://junglewise.ai/threats/cve-2026-19569-dynamic-object-create-in-kernel-userspace-userspace-c-computed)