CVE-2026-44359: Meshtastic firmware arbitrary code execution in GitHub Actions workflow

CVE-2026-44359 · Severity: critical · CVSS 10 · Published 2026-07-20

Executive brief

Meshtastic, an open-source mesh networking solution, was found to have a critical security flaw in its automated software building process (GitHub Actions). An attacker could submit a malicious code proposal (pull request) that would automatically trigger the system to run the attacker's code with high-level administrative privileges. This could allow an attacker to steal sensitive digital signing keys, distribute malicious firmware to users, or take full control of the project's code repository.

Technical details

The vulnerability exists in the 'main_matrix.yml' GitHub Actions workflow, which used the 'pull_request_target' trigger without an approval gate for external contributors. Multiple jobs (check, build, and build-debian-src) would check out code from an attacker's fork and execute it directly. Because 'pull_request_target' runs in the context of the base repository, the attacker-controlled scripts had access to sensitive secrets like 'PPA_GPG_PRIVATE_KEY' and 'DIST_PAGES_DEPLOY_KEY', as well as a 'GITHUB_TOKEN' with 'contents: write' permissions. This allowed for potential supply chain attacks, persistent compromise of self-hosted runners, and full repository takeover. The issue was patched in version 2.7.21.1370b23.

CVE-2026-44359: Meshtastic firmware arbitrary code execution in GitHub Actions workflow

Executive brief

Technical details

Affected products

Timeline

References