Security researcher Olivier Laflamme published details on August 27, 2026 of two independent remote code execution chains with root privileges on the Unitree G1 EDU robot. The vulnerabilities are tracked as CVE-2026-76639 and CVE-2026-76640. The first can be exploited from an adjacent network, the second via Bluetooth Low Energy from physical proximity. Public proof-of-concept (PoC) code is available; however, no confirmed fixed firmware version exists, and no evidence of exploitation in real-world attacks has been found so far.
Technical details of the vulnerabilities
CVE-2026-76639: network chain via chat_go and bashrunner
According to the entry in the GitHub Advisory Database, vulnerability CVE-2026-76639 has been rated CVSS v4 8.7 (High). The attack vector assumes access from an adjacent network, requires no privileges and no user interaction, and its impact on confidentiality, integrity and availability is rated as High.
The exploitation chain combines several weaknesses:
- Unauthenticated WebRTC-to-DDS bridge on TCP port 9991
- Static AES-128 key readable by all users on the system
- Path traversal vulnerability in the data upload API of the chat_go component
Exploitation makes it possible to restart the bashrunner process, place a malicious payload in the script execution directory and run arbitrary commands as uid 0 on the robot’s control computer (Locomotion PC). According to the advisory, firmware versions up to and including 1.5.2 are affected; the fixed version is listed as unknown.
CVE-2026-76640: BLE chain with buffer overflow
The second chain, documented in the UniBLEed repository, starts with a BLE interaction that accepts an initial connection without Bluetooth pairing. The attacker then obtains an authenticated BLE state required for Wi-Fi provisioning operations.
The key element of the chain is a 1,050-byte buffer overflow in the BSS segment of the btgatt-server process during Wi-Fi provisioning. The result is arbitrary code execution with root privileges on the Locomotion PC. After the callback is triggered, the process is deliberately terminated with a crash.
It should be noted that CVE-2026-76640 was not found in independent vulnerability registries (NVD, CVE.org, GitHub Advisory Database) at the time of verification, which lowers the confidence level in its formal status compared with CVE-2026-76639.
The role of the cloud service in the BLE attack chain
During the research, Laflamme discovered that the Unitree cloud service accepted a request to recover key material from any valid Unitree account without checking whether the specified robot actually belonged to that account. This made it possible to obtain the cryptographic material of someone else’s G1 EDU and use it to establish an authenticated BLE connection.
According to the researcher, Unitree fixed the check binding an account to a robot, which breaks the PoC scenario described. However, the exact date and completeness of this fix have not been independently verified — the researcher’s repository describes the current server behavior as “possible enforcement of ownership verification,” rather than a confirmed change.
Testing of attack propagation was limited to two G1 robots in a single room and does not demonstrate the possibility of mass or worm-like propagation.
Impact assessment
The confirmed scope of affected devices is limited to the Unitree G1 EDU model. The official product page from Unitree lists G1 and G1 EDU as separate models; applicability of the vulnerabilities to other Unitree robots has not been confirmed.
The G1 EDU model is marketed as an educational and research platform. Gaining root access on the Locomotion PC means full control over the robot’s motor functions, creating physical safety risks in laboratory and educational environments. The network vector (CVE-2026-76639) is particularly dangerous in university and corporate networks, where adjacent access may be relatively easy to obtain.
The availability of public PoC code increases the likelihood of attack reproduction, although at this time there are no confirmed cases of exploitation in real-world conditions, and the vulnerabilities are not included in the CISA KEV catalog.
Recommendations
- Network isolation: restrict access to TCP port 9991 on the G1 EDU robot. Place devices in an isolated network segment that is not reachable from general user VLANs.
- BLE access control: restrict physical access to the robots. The BLE vector requires proximity, so placing robots in controlled rooms reduces the risk.
- Process monitoring: monitor for abnormal restarts of bashrunner and crash terminations of btgatt-server on the Locomotion PC as potential indicators of exploitation attempts.
- Firmware updates: follow official Unitree channels for information on a confirmed fixed version. At the time of publication, neither the GitHub Advisory nor the vendor has specified an exact firmware version containing fixes.
- Cloud binding audit: ensure that your robot is bound to the correct Unitree account and review the binding history if this is supported by the platform.
Owners of Unitree G1 EDU should immediately isolate the devices at the network level and restrict physical access until a confirmed firmware update is released. The absence of a verified patch in the presence of public PoC code makes temporary network segmentation measures the only reliable way to reduce risk at this time.
