CVE-2026-44359: Meshtastic Workflow RCE Vulnerability

CVE-2026-44359 Overview

CVE-2026-44359 affects the Meshtastic firmware repository's GitHub Actions workflow main_matrix.yml. The workflow uses the pull_request_target trigger while checking out attacker-controlled code from external forks. Multiple jobs (check, build, and build-debian-src) execute this untrusted code with access to repository secrets and an elevated GITHUB_TOKEN. No approval gate exists for pull requests from external contributors with author_association: "NONE". Versions prior to 2.7.21.1370b23 are vulnerable, and exploitation could lead to supply chain compromise, self-hosted runner takeover, or full repository takeover.

Critical Impact
External attackers can execute arbitrary code with repository secrets and write-capable GITHUB_TOKEN permissions, enabling supply chain compromise of the Meshtastic firmware project.

Affected Products

Meshtastic firmware repository (meshtastic/firmware) prior to version 2.7.21.1370b23
GitHub Actions workflow main_matrix.yml (jobs: check, build, build-debian-src)
Downstream Meshtastic firmware builds produced by the affected CI pipeline

Discovery Timeline

2026-07-20 - CVE-2026-44359 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-44359

Vulnerability Analysis

The vulnerability is a code injection flaw [CWE-94] in GitHub Actions CI configuration. The main_matrix.yml workflow triggers on pull_request_target, which runs in the context of the target repository with access to secrets. Unlike the standard pull_request trigger, pull_request_target grants a privileged GITHUB_TOKEN and secret access to the workflow run.

The workflow then performs actions/checkout against the pull request head, pulling attacker-controlled files from the fork. Build steps directly execute scripts and configuration from that checkout. Any external contributor could open a pull request containing modified build scripts and immediately execute code inside the trusted CI environment.

This issue is distinct from GHSA-6mwm-v2vv-pp96, which addressed a separate command injection through github.head_ref in the setup job. That prior fix moved the value into environment variables but did not remove the fork checkout across the check, build, and build-debian-src jobs.

Root Cause

The root cause is the combination of two unsafe patterns in a single workflow: the pull_request_target trigger and an unpinned checkout of the pull request head reference. GitHub documentation explicitly warns against this combination. No environment: gate, label check, or author_association filter existed to restrict execution to trusted contributors.

Attack Vector

An attacker forks meshtastic/firmware, modifies a script referenced by the workflow (for example, a build helper or packaging script), and opens a pull request. GitHub Actions automatically launches main_matrix.yml. The runner checks out the attacker's fork, executes the malicious script with GITHUB_TOKEN and repository secrets exposed as environment variables, and can then exfiltrate credentials, publish malicious release artifacts, or persist on self-hosted runners.

bash

# Security patch in debian/ci_pack_sdeb.sh - hardens signing step for fork builds
dch --create --distribution "$SERIES" --package "$package" --newversion "$PKG_VERSION~$SERIES" \
    "GitHub Actions Automatic packaging for $PKG_VERSION~$SERIES"

if [[ -n $GPG_KEY_ID ]]; then
    # Build and sign the source deb
    debuild -S -nc -k"$GPG_KEY_ID"
else
    # Build the source deb without signing (forks)
    debuild -S -nc
fi

Source: GitHub Commit 5716aeba

Detection Methods for CVE-2026-44359

Indicators of Compromise

Workflow runs of main_matrix.yml triggered by pull requests from accounts with author_association: "NONE" prior to the patch
Unexpected outbound network connections from GitHub-hosted or self-hosted runners during CI jobs
Unauthorized commits, releases, or tags created using the repository GITHUB_TOKEN
New or rotated secrets that do not correlate to maintainer activity

Detection Strategies

Audit GitHub Actions run logs for pull_request_target events combined with checkouts of github.event.pull_request.head.sha or refs/pull/*/merge
Review the Actions tab for workflow runs initiated by first-time or external contributors before the patch commit 5716aeba
Correlate GITHUB_TOKEN API activity with workflow run identifiers to spot token abuse

Monitoring Recommendations

Enable GitHub audit log streaming and alert on workflows.completed_workflow_run events tied to external forks
Monitor self-hosted runner hosts for process, network, and file system anomalies during CI execution
Track release artifact hashes and signatures to identify unauthorized publications from the CI pipeline

How to Mitigate CVE-2026-44359

Immediate Actions Required

Upgrade the Meshtastic firmware repository configuration to version 2.7.21.1370b23 or later, which contains the workflow fix
Rotate all repository secrets, deploy keys, and signing keys (including GPG_KEY_ID) that were exposed to the affected workflow
Review recent releases and container images for tampering, and republish signed artifacts if integrity cannot be confirmed
Retire or reimage any self-hosted runners that executed pull requests from external forks

Patch Information

The fix is included in Meshtastic firmware version 2.7.21.1370b23 via commit 5716aeba3bc1e1d34fba9567ff88917ede4a78a5. Full details are documented in the GitHub Security Advisory GHSA-mjx5-98jq-q736 and the related GHSA-6mwm-v2vv-pp96.

Workarounds

Replace pull_request_target with pull_request for jobs that must check out fork code, removing access to secrets
Split the workflow so that only trusted, read-only preprocessing runs under pull_request_target and untrusted code runs in an isolated pull_request job
Require the environment: protection rule with manual approval before jobs that access secrets execute
Restrict GITHUB_TOKEN permissions to contents: read at the workflow level and grant elevated scopes only to specific jobs