What happened and why it matters
A BLE‑based flaw can hand over full root control of Unitree’s G1 EDU humanoid robot, and a separate network‑adjacent bug can do the same via the robot’s cloud‑linked Locomotion PC.
Both vulnerabilities give an attacker the ability to run arbitrary code as root, effectively stealing the robot and any data it processes. In a lab, the researcher demonstrated the chain on two robots placed in the same room.
Technical breakdown
CVE‑2026‑76639 – The attack walks through the robot’s chat_go service and the bashrunner component. A crafted request reaches the Locomotion PC and spawns a root shell without needing physical access.
CVE‑2026‑76640 – It starts with a Bluetooth Low Energy (BLE) write that the robot accepts even before a pairing step. The write triggers a buffer overflow inside the Wi‑Fi provisioning code, which then escalates to root on the same Locomotion PC.
The two chains converge on the same privileged component, meaning an attacker who can either talk to the robot over the network or over BLE can take complete control.
Who is affected
The only confirmed target is the Unitree G1 EDU model. Unitree’s product page lists the G1 and G1 EDU as distinct, and there is no public evidence that other Unitree robots share these flaws.
Defensive steps
Until a patched firmware version is publicly confirmed (unverified), organisations should take the following mitigations:
- Restrict BLE access to trusted zones; disable Bluetooth on robots that do not require it.
- Segment the robot’s network from critical infrastructure and enforce strict firewall rules around the
chat_goandbashrunnerports. - Rotate any recovered keys immediately and consider revoking existing BLE authentication credentials.
- Monitor cloud‑account interactions for unexpected key‑recovery requests; enforce multi‑factor approval for such actions.
- Stay alert for an official firmware update from Unitree and apply it as soon as it is released.
Unitree already patched the cloud account‑to‑robot ownership check in July 2026, which breaks the exact proof‑of‑concept flow that relied on an unauthenticated key‑recovery request.