Researchers have uncovered a severe vulnerability in Unitree G1 humanoid robots, enabling attackers within Bluetooth range to gain root-level access. This critical flaw affects the robot’s locomotion computer, which governs its movement, cameras, and other essential functions.
The UniBLEed Security Flaw
The security issue, known as UniBLEed, involves multiple stages of exploitation. It leverages Bluetooth Low Energy technology, the Unitree cloud API, and the robot’s Wi-Fi provisioning system. Hackers can use this flaw to execute root-level code on the robot’s control environment, impacting major hardware functions.
Assigned CVE-2026-76639 and CVE-2026-76640, the attack has been recreated on four Unitree G1 robots. The exploit begins with a Bluetooth service that allows writing without pairing, sending requests to a specific GATT characteristic to receive an encrypted package from the robot.
Exploiting Encryption Vulnerabilities
This exploit takes advantage of Unitree’s decrypt-and-bind endpoint, turning it into a decryption oracle for nearby robots. Attackers can retrieve the AES-128 encryption key, initially protected by RSA encryption, from this endpoint. The cloud API, devicebindExtData, would decrypt this data without verifying if the user account owned the targeted robot.
Hackers could use a free Unitree account to collect the necessary information from a nearby G1 robot, submit it to the cloud API, and obtain the robot-specific AES key. This oversight is an authorization failure, as the API fails to confirm the account-to-robot ownership link.
Wi-Fi and Bluetooth Exploitation Risks
After obtaining the AES key, attackers can finalize the Bluetooth handshake and send Wi-Fi setup commands. Researchers noted that by crafting an overlong password, attackers could manipulate the script handling Wi-Fi configurations, forcing the robot to connect to a malicious hotspot.
Further exploitation involves a flaw in the G1 Bluetooth server. A buffer overflow vulnerability allows attackers to corrupt memory by sending a large payload, potentially altering server processes and executing commands as root.
Another root code execution path exploits the ChatGo AI service and BashRunner service, using a path traversal issue to execute files with root privileges. This poses significant risks, as these Linux services control critical robot functions.
Preventive Measures and Future Outlook
In response, Unitree implemented ownership-binding checks for their cloud decryption endpoints in July 2026. Researchers advise robot owners to update to the latest firmware and apps, avoid exposing robots to unfamiliar Bluetooth devices, and isolate robot networks from sensitive systems.
Preventing such vulnerabilities is crucial to maintaining the security of robotic systems. By staying informed and applying necessary updates, users can safeguard their devices against potential threats.
