Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting Unitree Robotics' G1 EDU humanoid, including a Bluetooth Low Energy path that reaches root on the robot's Locomotion PC without pairing. The bugs — tracked as CVE-2026-76639 and CVE-2026-76640 — were published on August 27, 2026, and an authoritative fixed firmware version remains unverified in any accessible Unitree guidance.
Two Chains, One Robot
CVE-2026-76639 uses a path-traversal condition in a service called chat_go to reach the robot's bashrunner utility. Execution through bashrunner lands directly at root on the Locomotion PC. Laflamme treated it as an independent RCE and reused it as a disclosure primitive while demonstrating the second chain. CVE-2026-76640 begins from BLE proximity: a write to characteristic 0xFFE2 is accepted without Bluetooth pairing, and a heredoc injection in the wpa_connect.sh script forces the robot onto the attacker's Wi-Fi hotspot. From that pivot, a 1,050-byte overflow of the 500-byte wifi_ssid BSS buffer in the btgatt-server binary corrupts the event loop into calling system() as root.
The Cloud Gap That Made Cross-Owner Attacks Possible
During the research, Unitree's cloud service accepted a valid Unitree account for a key-recovery request without verifying that the account owned the supplied robot. The authorization gap allowed one account holder to recover the AES key material of another G1 EDU, which could then be used to establish the authenticated BLE state needed for Wi-Fi provisioning. Laflamme said Unitree patched the ownership check in July 2026, closing the cross-owner arbitrary-G1 path. As of the August 27 disclosure, a G1 owner could still use an account bound to their own robot to recover its key.
Attack Range And Propagation Risk
An attacker within roughly 30 meters of a G1 EDU can chain the disclosed flaws to reach root code execution on the locomotion computer that controls movement, cameras, speakers, voice features and other peripherals. Once compromised, the robot can automatically scan for and infect other Unitree units within Bluetooth range, creating a propagating exploit chain that requires no user interaction. Laflamme limited his propagation proof to two G1 robots in one room and said the July cloud fix breaks that exact flow.
What Buyers Should Do Now
Unitree distinguishes the G1 and G1 EDU as separate models, and the broader applicability of the two new vulnerabilities to other Unitree platforms remains unconfirmed. Until a specific fixed firmware version is documented, operators of the G1 EDU should segment the robot away from production Wi-Fi, disable BLE where possible, and treat any physical event within Bluetooth range as an untrusted network zone. The disclosure lands the same week Unitree and rival AgiBot show off their humanoids at IFA Berlin 2026, and follows earlier vendor RCE disclosures such as the Universal Robots PolyScope 5 command-injection bug. The Hacker News reported that it has asked Unitree to confirm fixed firmware versions and affected product scope.
Reporting based on coverage from The Hacker News, Security Affairs and researcher Olivier Laflamme's technical writeup.