CVE-2026-44359 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-44359 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-44359 is a critical CI/workflow vulnerability in Meshtastic with a CVSS score of 10.0. In affected versions prior to 2.7.21.1370b23, the main_matrix.yml GitHub Actions workflow used pull_request_target and then checked out attacker-controlled fork code in multiple jobs, executing it with access to repository secrets and elevated GITHUB_TOKEN permissions. There was no approval gate for external pull requests with author_association: "NONE", so untrusted code could run automatically in CI.

This is a supply-chain class issue: an attacker could potentially steal secrets, compromise self-hosted runners, tamper with build outputs, or take over the repository workflow environment. Although not currently known to be exploited in the wild and not in CISA KEV, the severity is extreme and the fix should be treated as urgent.

Immediate Action

  • Upgrade immediately to Meshtastic 2.7.21.1370b23 or later. If you package Meshtastic internally, pin the patched release now.
  • Pause or restrict external PR CI until patched. If you cannot upgrade today, disable the affected workflow or require manual approval for forked PRs.
  • Rotate any secrets exposed to GitHub Actions if the repo accepted external pull requests while vulnerable. Treat tokens, deploy keys, and signing secrets as potentially exposed.
  • Review self-hosted runners for suspicious jobs, unexpected network activity, or unknown binaries. Rebuild runners if you see any signs of compromise.
  • Check vendor guidance and release notes: Meshtastic security advisory / release notes.

Affected Versions

  • meshtastic repo/workflow prior to 2.7.21.1370b23 vulnerable.
  • 2.7.21.1370b23 and later: patched/safe.
  • If you vendor or mirror the workflow, any copy of main_matrix.yml with the fork checkout pattern is vulnerable until updated.

Resolution Guide

Meshtastic users and maintainers: update the repository/workflow to the patched version and remove any pattern that checks out untrusted fork code in privileged jobs.

# Git: move to the patched release/tag
git fetch --tags
git checkout 2.7.21.1370b23
git pull --ff-only

# If you consume a release artifact, re-download the fixed release
# TODO: replace with the official Meshtastic download URL
curl -LO "TODO: Meshtastic-2.7.21.1370b23.tar.gz"

JavaScript / npm / yarn / pnpm (if your project pins Meshtastic-related tooling or workflow helpers):

npm i meshtastic@2.7.21.1370b23
yarn add meshtastic@2.7.21.1370b23
pnpm add meshtastic@2.7.21.1370b23

Python / pip / pipx:

pip install --upgrade meshtastic==2.7.21.1370b23
pipx upgrade meshtastic
# If pipx is used, reinstall with the fixed version if needed:
pipx install "meshtastic==2.7.21.1370b23"

Java / Maven / Gradle:

<dependency>
  <groupId>TODO.group</groupId>
  <artifactId>TODO-artifact</artifactId>
  <version>2.7.21.1370b23</version>
</dependency>

./gradlew dependencies
# then update the version to 2.7.21.1370b23 in build.gradle

Linux package managers:

sudo apt update
sudo apt install --only-upgrade meshtastic
# If no package exists, use the vendor release artifact instead.

sudo yum update meshtastic
# or:
sudo dnf update meshtastic

Docker:

docker pull TODO/meshtastic:2.7.21.1370b23
docker run --rm TODO/meshtastic:2.7.21.1370b23 --version

Workflow hardening example for GitHub Actions: do not run untrusted fork code with secrets. Prefer separate unprivileged validation jobs, and require approval before privileged jobs.

jobs:
  check:
    permissions:
      contents: read
      pull-requests: read
    if: github.event.pull_request.head.repo.fork == false
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

Minimal fix pattern: ensure privileged jobs only check out trusted repository refs, not attacker-controlled fork content.

# BAD: checks out fork code in a privileged job
- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.pull_request.head.sha }}

# BETTER: use a safe, unprivileged validation path or trusted base ref
- uses: actions/checkout@v4
  with:
    ref: ${{ github.sha }}

Detection & Verification

Check your version:

git describe --tags --always
grep -n "main_matrix.yml\|pull_request_target\|actions/checkout" .github/workflows/main_matrix.yml

Look for the vulnerable pattern: any workflow that uses pull_request_target and then checks out fork code in jobs that have secrets or write permissions.

grep -RIn "pull_request_target\|head.repo.fork\|author_association" .github/workflows/

Dependency and config audit:

npm audit
pip audit
./gradlew dependencies
docker image inspect TODO/meshtastic:latest | grep -i version

Verify the fix: confirm the repository or image reports 2.7.21.1370b23 or later, and confirm the workflow no longer executes fork checkout code in privileged jobs.

grep -n "pull_request_target\|actions/checkout" .github/workflows/main_matrix.yml
git log --oneline -- .github/workflows/main_matrix.yml

Risk and Impact

If exploited, an attacker could run arbitrary code in CI with access to secrets, build credentials, and elevated GitHub token permissions. That can lead to secret theft, malicious release artifacts, compromised self-hosted runners, and in the worst case repository takeover or downstream supply-chain compromise. Even without confirmed in-the-wild exploitation, the blast radius is broad enough that teams should treat this as a production security incident.

Keep reading