CVE-2026-44359: Meshtastic CI/CD Workflow Exposes Repository Secrets (CVSS 10.0)

Executive Summary

A CVSS 10.0 critical vulnerability (CVE-2026-44359) has been disclosed in the Meshtastic open-source mesh networking project. The flaw stems from a misconfigured pull_request_target GitHub Actions workflow that executes attacker-controlled code from forked pull requests in a privileged context, exposing repository secrets and write access to the main repository.

The issue is patched in Meshtastic firmware version 2.7.21.1370b23.

Vulnerability Overview

Technical Details

The Meshtastic project's main_matrix.yml GitHub Actions workflow was configured with the pull_request_target trigger. Unlike the standard pull_request trigger — which executes in a sandboxed context without access to secrets — pull_request_target runs in the context of the target repository with full access to secrets and elevated permissions.

Multiple jobs within this workflow checked out and executed code from the attacker's fork, combining the dangerous trigger with untrusted code execution in a privileged environment.

Attack Flow

1. Attacker forks the Meshtastic GitHub repository
2. Attacker adds malicious code to the workflow or scripts in the fork
3. Attacker opens a pull request targeting the main repository
4. The pull_request_target trigger fires — running in main repo context
5. Attacker's fork code is checked out and executed with privileged access
6. Repository secrets (API keys, signing keys, tokens) are exfiltrated
7. Attacker can write to main branch or publish malicious releases

Why pull_request_target Is Dangerous

Affected Versions

Impact

A successful exploit could allow an attacker to:

• Exfiltrate repository secrets — API keys, code signing certificates, deployment tokens
• Push malicious code to protected branches if write tokens are exposed
• Compromise the software supply chain — inject backdoors into Meshtastic firmware releases
• Pivot to downstream infrastructure using leaked credentials
• Tamper with release artifacts distributed to thousands of Meshtastic devices

Remediation

Update Immediately

Update Meshtastic to version 2.7.21.1370b23 or later to receive the patched workflow configuration.

Audit Your Own GitHub Actions Workflows

If you maintain GitHub Actions workflows, audit them for this pattern:

# DANGEROUS — pull_request_target + checkout of untrusted code
on:
  pull_request_target:
jobs:
  build:
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # ATTACKER CODE

Safer Alternatives

# OPTION 1: Use pull_request (sandboxed, no secrets)
on:
  pull_request:
 
# OPTION 2: Split workflow — validate first, grant privileges only after approval
# Trigger privileged jobs only from trusted refs (main branch, not fork PR head)
on:
  pull_request_target:
jobs:
  build:
    steps:
      - uses: actions/checkout@v3
        # Checkout BASE repo code, NOT the fork's HEAD
        # with: ref: ${{ github.base_ref }}

Secret Rotation

If your repository used the affected workflow versions, treat all secrets as compromised:

# Rotate any secrets that could have been exposed:
# - GITHUB_TOKEN (auto-rotates per workflow run)
# - Custom secrets (manually rotate in Settings > Secrets)
# - Any API keys, signing certificates, or deployment tokens

Detection

Review Workflow Logs

# Check GitHub Actions audit log for suspicious workflow runs
# Settings > Security > Audit log > Filter: "workflow_run"
 
# Specifically look for pull_request_target workflow executions
# triggered by external fork PRs

Context: GitHub Actions CI/CD Security

The pull_request_target + untrusted checkout pattern is a well-documented pitfall in GitHub Actions security. The GitHub Security Lab has published guidance on this class of vulnerability, which has affected dozens of high-profile open-source projects. The Meshtastic case demonstrates how even security-conscious open-source projects can introduce this risk through workflow growth and copy-paste.

References

• NVD — CVE-2026-44359
• GitHub Security Lab — Keeping your GitHub Actions and workflows secure
• Meshtastic Project

Related Reading

• CVE-2026-13147: Kirki WordPress Plugin SSRF Flaw
• GitHub Actions Supply Chain: Trivy Tags Hijacked in CI/CD Attack
• GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Python Repos