A LoRa mesh like Meshtastic trusts whoever knows its channel password. That works fine among friends who all typed the same key into their radios. It works a lot less well the moment you ask what actually stops a stranger’s radio from doing the same thing. Our partner Eduardo Contreras — Wero to most of us — built a small research project to find out, and we think it deserves a real look instead of a one-line announcement.

What does MeshCanvas do?

MeshCanvas is a webapp: you draw a shape on a map, and it renders that shape as a batch of synthetic nodes, broadcast over LoRa through a CatSniffer v3. Wero rebuilt the Meshtastic radio protocol from scratch to do it — the packet format, the encryption, the channel math, even the timing a radio chip is allowed to use — reading every constant straight out of Meshtastic’s own firmware instead of guessing.

It ships three modes, and the risky one isn’t the default. dry-run builds and encrypts every frame without transmitting anything, so you see your shape and your airtime cost before a single packet goes on air. mqtt publishes without touching a radio. Only rf actually keys a transmitter. We’d pick dry-run first too.

What does it actually demonstrate about Meshtastic security?

Here’s the part that matters: Meshtastic encrypts a channel with one shared key, and that key proves you’re a member of the channel — not which node you are. Wero’s tool shows what that means in practice. He pointed a CatSniffer v3 at his own private channel, transmitted synthetic node and position packets for nodes that don’t exist, and a completely stock Meshtastic node received them, decrypted them, and drew them on its own map. Nothing was modified on the receiving side.

So if anyone holding the channel password can speak for any node number, who’s actually watching the map? Meshtastic’s own documentation calls this out directly: the design is “Trust On First Use,” and a shared key was never meant to prove who sent a given packet.

Which firmware version has this gap — and does it get fixed?

This isn’t a bug in one release; it’s how channel encryption has worked since the project’s early firmware, and it’s still true of the newest stable build, v2.7.26, shipped in June 2026. It isn’t purely theoretical, either: a related flaw let an attacker clear and then overwrite a real node’s saved identity key with two crafted packets. That one got a public vulnerability report and a fix in firmware v2.6.3.

A real fix is coming, not out yet. Firmware 2.8 adds a signature to each node’s broadcasts, tied to that node’s own key, so a receiver can check who actually sent a packet. It’s still in alpha as we publish this — the Meshtastic team says it “isn’t ready for wide deployment” — and even once it ships, its default setting still accepts unsigned packets from older radios. The gap MeshCanvas demonstrates keeps working against most of today’s mesh, upgrade or not, until someone turns that setting up.

What MeshCanvas does NOT do

It doesn’t touch anyone else’s encryption. A different channel means a different key, and a neighbor’s node simply can’t decrypt your frames — private test profile by default, with a freshly generated password every time you load it.

It also doesn’t need a Meshtastic radio nearby to run. dry-run exercises the whole pipeline on its own. And Wero is upfront about what’s still unverified: streaming mode hasn’t been confirmed on real hardware, and two routing fields ship as zero without a live test against the newest receivers.

Authorized use only

Point this at hardware you own, on a channel only you control. The tool defaults to a private test profile for exactly that reason. Transmitting on the real public Meshtastic channel — the one every stock radio powers up on — writes fake entries into every device nearby and eats airtime other people depend on; do that only inside RF isolation, never in a populated area.

Where to look

The project is open: github.com/ElectronicCats/meshcanvas, credit to Eduardo Contreras for building and documenting it. The hardware behind it is our CatSniffer v3, the board MeshCanvas uses as its transmitter. For the Meshtastic side, their own write-up on this limit is worth a read: meshtastic.org’s known limitations page.

Now go test your own mesh, and let your cat supervise. Happy hacking!