In a recent disclosure, cybersecurity expert Olivier Laflamme revealed two significant vulnerabilities affecting the Unitree G1 EDU robots. These security flaws, identified as CVE-2026-76639 and CVE-2026-76640, offer potential pathways for remote code execution (RCE), one of which exploits Bluetooth Low Energy (BLE) to achieve root access on the robot’s Locomotion PC.
Understanding the Security Breaches
The first vulnerability, CVE-2026-76639, involves a network-adjacent flaw that leverages chat_go and bashrunner to facilitate unauthorized access. In contrast, CVE-2026-76640 originates from a BLE proximity issue, allowing an unpaired Bluetooth device to initiate the breach.
Despite the critical nature of these vulnerabilities, Unitree has not yet confirmed the availability of a fixed firmware version to address these issues. This uncertainty leaves G1 EDU robot owners in a precarious position, unsure of when a reliable solution will be provided.
Details of the Vulnerability Exploits
According to Laflamme’s research, the flaw CVE-2026-76639 exploits a path-traversal condition in the chat_go application, which then interacts with bashrunner to execute root-level commands on the Locomotion PC. Meanwhile, the BLE-related CVE-2026-76640 accepts initial interactions without requiring Bluetooth pairing. Although the bootstrap data remains secure, subsequent Wi-Fi provisioning necessitates an authenticated BLE connection.
During his study, Laflamme discovered that Unitree’s cloud services allowed account-based key recovery without verifying account ownership of the involved robot. This oversight could enable unauthorized access to critical key material, further facilitating the exploit.
Unitree’s Response and Future Steps
Unitree addressed a component of the issue by patching the cloud account ownership verification in July 2026. However, as of late August 2026, the precise version of firmware that resolves these vulnerabilities remains unclear, prompting inquiries from the cybersecurity community.
The Hacker News has reached out to Unitree for additional insights into the firmware status, the extent of affected models, and the company’s plans for remediation. Updates will be provided as more information becomes available.
These discoveries highlight the pressing need for vigilance in IoT device security, emphasizing the importance of timely firmware updates to safeguard against emerging threats.
