External risk intelligence

Meshtastic Workflow Compromise Via Forked Pull Requests

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-44359

This vulnerability exists within a build-time CI/CD workflow configuration (GitHub Actions). It is not part of a deployed application, network service, or product interface reachable by end users, but rather a development-time process restricted to the repository environment.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in the Meshtastic open-source project's development workflow that could have allowed unauthorized code execution from external contributions. This could potentially lead to compromises within the project's repository or self-hosted build systems. The main concern is confirming if this development process is relevant to any current or future business operations.

Code workflow flaw allows outside code execution.
Could compromise development and repository access.
Confirm relevance to current business operations.

Attack Path

How an attacker could exploit the issue

An attacker could compromise the Meshtastic project by submitting a pull request to the GitHub repository. The continuous integration workflow automatically checks out code from the attacker's fork without a prior approval step, granting it access to repository secrets and elevated permissions. This allows the attacker to execute arbitrary code within the build environment, potentially leading to a supply chain attack or takeover of the repository.

No prior approval needed.
Pull requests trigger code execution.
Risk of supply chain compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity of the Meshtastic GitHub repository's build process when pull requests are merged. Specifically, an attacker could potentially execute code within the repository's environment, leading to the compromise of repository secrets or self-hosted runners.

Repository secrets and runner integrity at risk.
Malicious code executed via pull request.
Supply chain or repository takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Meshtastic development team is responsible for addressing this vulnerability within their GitHub Actions CI/CD workflow. The immediate first step is to confirm the specific repository and workflow configurations in use, assess any potential exposure to code from untrusted forks, and verify if the repository secrets are adequately protected against compromise. Planning for remediation should then focus on updating the workflow to prevent the execution of untrusted code during the pull request process.

Meshtastic development team owns resolution.
Verify workflow and secret protection.
Update CI to prevent untrusted code execution.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Meshtastic?

Meshtastic is an open-source project that provides mesh networking software, allowing devices to communicate over long distances using radio protocols. It relies on GitHub repositories to manage its code development, including automated build processes that prepare the software for release.

What does CVE-2026-44359 mean for security?

This CVE involves improper control of generation of code and inclusion of functionality from untrusted control sphere. In plain English, the project's automated build system was configured to automatically run code submitted by external users without checking if it was malicious, which could allow an attacker to gain unauthorized control over build tools.

How is this Meshtastic vulnerability triggered?

The flaw is triggered when an external user submits a pull request to the project's repository. Because the workflow automatically checked out and ran code from these external submissions, it did not require manual approval. Normal repository use that does not involve submitting code through these specific automated build workflows does not trigger this issue.

Is this vulnerability relevant to my network?

According to Halo Surface Signal, this vulnerability is very unlikely to affect your live systems. It exists entirely within a development-time CI/CD workflow rather than a deployed application or network service. It is a risk to the project's own repository integrity rather than an internet-facing flaw in the devices themselves.

What is the first step for those using this software?

If you are using or building upon the Meshtastic source code, you should update to version 2.7.21.1370b23 or later, which contains the patch for this workflow issue. Developers should also verify that their own repository secrets and build runners are secured against unauthorized access from untrusted external code contributions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.