Security researcher Olivier Laflamme has disclosed two separate remote code execution chains affecting Unitree Robotics’ G1 EDU humanoid robot, including one that can begin over Bluetooth without pairing or credentials and reach root access on the robot’s Locomotion PC.
The vulnerabilities, identified as CVE-2026-76639 and CVE-2026-76640, were publicly disclosed on August 27, 2026. The published CVE records identify G1 EDU firmware through version 1.5.2 as affected. CVE-2026-76639 has a CVSS 4.0 score of 8.7, while CVE-2026-76640 has a score of 7.7. Both are rated high severity.
Laflamme’s research, published in a detailed technical report titled UniBLEed, describes two different paths to root code execution. The first uses weaknesses in the G1’s network-facing software, including its WebRTC-to-DDS bridge and the robot’s chat_go knowledge-upload service. The second starts from Bluetooth Low Energy and chains several weaknesses in the G1’s BLE and Wi-Fi provisioning systems.
The Bluetooth chain, tracked as CVE-2026-76640, begins with the G1’s BLE service. According to the researcher and the CVE record, the 0xFFE2 GATT characteristic accepted writes without requiring Bluetooth pairing. That allowed a nearby device to interact with the robot’s provisioning process without first establishing a paired Bluetooth connection.
Laflamme found that the BLE bootstrap process could provide access to encrypted material containing the robot’s AES-128 key. During the period covered by the research, Unitree’s /device/bindExtData cloud endpoint could decrypt that material for an authenticated Unitree account without checking whether the account actually owned the supplied G1 serial number. The researcher said Unitree subsequently added an account-to-robot ownership check.
After recovering the key, the attack chain could proceed through the G1’s AES-protected BLE protocol and Wi-Fi configuration functions. Laflamme found that attacker-controlled Wi-Fi data could reach an unsafe fallback in the provisioning process, where data was inserted into a Wi-Fi configuration through an unquoted shell heredoc. The resulting chain could force the robot to connect to an attacker-controlled hotspot.
The research then used the robot’s chat_go service to obtain information needed for the final stage of the Bluetooth attack. The published CVE description says the chain includes a buffer overflow in the SSID chunk accumulator. A crafted BLE write can overflow a fixed buffer, corrupt an adjacent event-loop dispatch entry and ultimately cause attacker-controlled data to reach system() running as user ID 0.
Laflamme describes the final corruption as a 1,050-byte write against a 500-byte wifi_ssid buffer. The researcher said the overwritten event-loop data could survive the resulting btgatt-server crash and leave a backgrounded shell running with root privileges.
The separate CVE-2026-76639 chain does not start with Bluetooth. The CVE record describes an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions and a path traversal flaw in the chat_go knowledge-upload API. Together, these weaknesses can allow a network-adjacent attacker to publish DDS control messages, restart the bashrunner service, place a malicious file in its script execution directory and have that payload executed as root.
The two vulnerabilities therefore represent different attack paths against the same robot. CVE-2026-76639 is rated CVSS 4.0 8.7 because of its network-adjacent root execution impact, while CVE-2026-76640 is rated 7.7 and requires proximity to the robot for the Bluetooth-based attack. The CVE records list no privileges or user interaction as required for either chain.
Laflamme’s research also examined what access to the G1’s Locomotion PC could provide. The researcher describes that computer as a Linux-based Rockchip RK3588 system involved in operating the robot and connected to functions including cameras, audio and motors. The research also reported finding about 15 high-impact secrets on the system, including authentication material related to cloud services and application or JWT signing. Laflamme said those secrets were believed to have been rotated. The research does not establish that customer cloud accounts were compromised using those secrets.
Another significant finding was the ability to make the Bluetooth attack chain wormable during testing. Laflamme said one compromised G1 could be used to attack another G1 within Bluetooth range and reported testing propagation between two G1 robots in the same room. However, the cloud authorization weakness used in the disclosed propagation flow was subsequently patched by Unitree, so the research does not establish that G1 robots are currently spreading the exploit in the wild.
Unitree worked directly with Laflamme during the disclosure process. According to the researcher’s timeline, the G1 EDU arrived for the research on April 29, the first root RCE was achieved on May 8-10, and Unitree verified that issue on May 14. Laflamme said the cloud key-recovery authorization problem was identified on May 21, the full Bluetooth RCE chain was discovered on June 25, and Unitree verified the second RCE between June 26 and June 30.
The researcher said Unitree implemented the account ownership check between July and early August, and that the company paid a total bounty of $6,700 on August 6. The published research describes $4,000 for the Bluetooth RCE and $1,000 for the chat_go RCE, while the report’s headline describes the overall bounty as $6,700, reflecting additional research-related compensation in the disclosure.
The CVE identifiers were submitted on August 18 and obtained on August 20, before the public research was released on August 27. The published CVE records credit Olivier Laflamme as the finder.
Unitree’s response also includes patches for the issues identified during the research. Laflamme said the company’s security contacts indicated that it had already been aware of some of the issues internally and had patches for most or all of the vulnerabilities by the time of publication. The researcher also described Unitree’s security team as responsive throughout the disclosure process.
At the same time, an exact publicly verified firmware release fixing both newly disclosed robot-side vulnerabilities had not been established in the sources reviewed. The current CVE records continue to identify G1 EDU firmware through 1.5.2 as affected. Owners and operators should therefore consult Unitree’s official security guidance and firmware documentation rather than assume that an updated installation is protected solely because the cloud authorization issue has been fixed.
The findings also follow an earlier Unitree security disclosure. In 2025, researchers published CVE-2025-35027, a separate command-injection vulnerability affecting multiple Unitree robots, including the G1. The vulnerability allowed a malicious value supplied during BLE-based Wi-Fi configuration to reach a shell script and ultimately execute commands as root. NIST lists G1 firmware through version 1.4.4 as affected by that earlier vulnerability.
A related 2025 issue, CVE-2025-60250, concerned the use of a hard-coded cryptographic key and initialization vector for decrypting BLE packet data on Unitree’s Go2, G1, H1 and B2 devices through September 20, 2025. That earlier research was published as part of the UniPwn work.
UniBLEed is publicly available, including proof-of-concept research code, on Laflamme’s GitHub repository. The repository warns that the demonstrations can alter Wi-Fi settings, restart services, crash processes and execute commands as root and should only be used against authorized robots.
The newly disclosed issues do not by themselves establish active exploitation of Unitree G1 robots in the wild. They do, however, show that security weaknesses in the robot’s Bluetooth, cloud, Wi-Fi provisioning and internal software components could be chained into root-level control of the G1 EDU, including through a Bluetooth path that does not require pairing or credentials.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
