CVE-2026-44359 is a critical supply chain vulnerability affecting Meshtastic open-source mesh networking software and its GitHub Actions CI/CD pipeline. The 'main_matrix.yml' workflow, triggered by 'pull_request_target' events, improperly executes code from untrusted forks without approval mechanisms. This allows attackers to submit malicious pull requests from external repositories, bypassing security checks. The vulnerable workflow checks out and runs attacker-controlled code with elevated privileges, including access to repository secrets and a high-privilege GITHUB_TOKEN. Successful exploitation could lead to full CI/CD system compromise, secret exfiltration, and downstream supply chain attacks. All Meshtastic users on versions prior to 2.7.21.1370b23 are affected. Immediate remediation requires upgrading to the patched version and implementing strict CI/CD approval gates for external contributions. Organizations using similar GitHub Actions configurations should audit workflows for untrusted code execution risks.