Is CVE-2026-44359 actively exploited?

No active exploitation of CVE-2026-44359 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44359 be exploited remotely?

Yes. CVE-2026-44359 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44359?

CVE-2026-44359 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-44359

CRITICAL

CVE-2026-44359

CWE-94Published: July 20, 2026· Updated: Jul 24, 2026

10.0

CVSS v3.1

EPSS:1.00%probability of exploitation in 30 daysPercentile:59.1th

Official Description

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

NVD Source

Risk Analysis

The Meshtastic CI workflow is vulnerable to unauthorized code execution because it automatically processes pull requests from external users without an approval gate. This allows an attacker to execute arbitrary code with elevated permissions and access repository secrets, leading to potential supply chain compromise. The critical CVSS score reflects the high impact of a full repository takeover.

No public exploit is known for this vulnerability, and it is not currently listed in CISA KEV. The vulnerability is remotely exploitable due to the nature of the CI workflow trigger.

Recommended Action

Upgrade to Meshtastic version 2.7.21.1370b23 or later. Implement strict approval gates for CI workflows triggered by pull requests from external contributors.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-44359 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.