VulnSocial

CVE-2026-44359Disclosure

MEDIUMCVSS 10.0 · CRITICAL

Exploitation ongoing with high activity in latest observed window (5 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

Back to dashboard
5.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-829

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 5 total mentions across 1 day

Deep dive

Activity timeline5 mentions / 1d
01345Mentions · 2026-07-20: 5PoC Mentioned / Linked · 2026-07-20: 1Active Exploitation · 2026-07-20: 1Patch / Workaround · 2026-07-20: 3Technical Details · 2026-07-20: 507-20
Signal classification4 categories
Disclosure
240.0%
Active Exploitation
120.0%
General
120.0%
Patch
120.0%
Referenced assets5 URLs
Full discourse5 posts
  • Marcell Ujlaki@UjlakiMarci
    Disclosure

    Well, this is not good: 🟥 [New] CVE-2026-44359 | Meshtastic Firmware, CVSS: 10.0 (Critical) a security flaw in the automated systems used to build and test the code the project automatically runs code from outside contributors without verification. because these processes have high permissions, an attacker can run malicious commands an attacker could hijack the project, steal secret keys, or inject malicious software into the supply chain version 2.7.21.1370b23 contains a patch for thie issue POC video: https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing

    Post summary

    A new critical CVE (CVE-2026-44359) affecting Meshtastic firmware is disclosed, detailing how unverified external code can exercise high‑permission commands, a patch is available, and a POC video is provided.

    20010150
    353 followersView on X
  • Marcell Ujlaki@UjlakiMarci
    General

    CWE-94: Improper Control of Generation of Code ('Code Injection')GitHub, Inc. CWE-829: Inclusion of Functionality from Untrusted Control Sphere #EUVD: https://euvd.enisa.europa.eu/vulnerability/CVE-2026-44359 #NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44359

    Post summary

    The post simply cites CVE-2026-44359 with associated CWEs and links to EUVD and NVD records, providing minimal context.

    0000023
    353 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨 CRITICAL - Meshtastic GitHub Actions pull_request_target secret exposure & CI RCE (CVE-2026-44359) Meshtastic firmware’s GitHub Actions workflow (main_matrix.yml) used the pull_request_target trigger and then checked out and executed code from an attacker-controlled fork while still having access to repository secrets and elevated GITHUB_TOKEN permissions. The root cause is an insecure CI/CD workflow configuration (improper use of pull_request_target plus missing approval gate), enabling untrusted code execution in a privileged context. An attacker can exploit this by opening a PR from a fork that causes the workflow to run attacker-supplied files/steps, harvesting secrets or abusing the token without needing prior repo access beyond submitting a PR. Impact includes supply-chain compromise via malicious build artifacts, compromise of self-hosted runners, secret exfiltration, and potential repository takeover through token abuse. 👉 Affected: Meshtastic firmware GitHub Actions workflow main_matrix.yml (pre-2.7.21.1370b23) | Upgrade to 2.7.21.1370b23

    Post summary

    CVE‑2026‑44359 describes a critical CI RCE on Meshtastic’s GitHub Actions workflow triggered via pull_request_target, and a patch to version 2.7.21.1370b23 is available; no proof of active exploitation or PoC code is provided.

    00000142
    255 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Active Exploitation

    #CVE-2026-44359 - Critical CI/CD command injection in Meshtastic. CVSS 10. Unpatched. Attacker code executed with repo secrets access via pull_request_target. No approval gate. Disable workflow or restrict PR access immediately. #CVE #infosec #Meshtastic #devops #devsecops #developer https://www.valtersit.com/cve/CVE-2026-44359

    Post summary

    CVE‑2026‑44359 is a critical CI/CD command injection actively exploited in GitHub Actions; immediate workflow disablement or PR access restrictions are advised while a patch is awaited.

    0000073
    985 followersView on X
  • SecNews@SecNews_GR
    Disclosure

    Meshtastic: Critical GitHub Actions flaw με pull_request_target επιτρέπει supply chain compromise (CVE-2026-44359) https://secn.ws/u7QOFu

    Post summary

    A new critical flaw in GitHub Actions (CVE-2026-44359) that enables supply chain compromise via pull_request_target has been announced.

    00000145
    7.0K followersView on X

Explore more

Back to dashboard