Two vulnerabilities in Unitree's G1 humanoid robot give an unauthenticated attacker within Bluetooth range a path to root-level remote code execution on the robot's Locomotion PC, the real-time Linux system that controls motors, cameras, audio, and voice1,2,5.
Security researcher Olivier Laflamme published the findings on August 27, 2026, under the name UniBLEed4,3. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640.
CVE-2026-76640, the Bluetooth chain, begins at GATT characteristic 0xFFE2, which accepted writes with basic WRITE permission, requiring no BLE pairing or authentication. A cleartext bootstrap command returned a robot-specific AES-128 key inside an RSA-encrypted response. Unitree's cloud API endpoint at /device/bindExtData would decrypt that material and return the plaintext key to any authenticated Unitree account, without verifying that the account owned the serial number submitted with the request. An attacker near a target could therefore recover the key needed for the robot's BLE version 3 provisioning and Wi-Fi setup.
With the key in hand, Laflamme accessed protected BLE functions and supplied a 121-byte pre-shared key that triggered an insecure Wi-Fi fallback in wpa_connect.sh. Attacker-controlled data entered an unquoted heredoc, allowing manipulation of the generated wpa_supplicant configuration so the robot connected to a rogue hotspot. The final stage targeted btgatt-server, a Bluetooth daemon running as root: a 1,050-byte value was written through a 500-byte wifi_ssid buffer. Combined with an information leak that weakened address-space layout randomization, the overflow caused system() to execute an attacker-defined command with root privileges. The Bluetooth service crashed afterward, but a background shell remained active.
CVE-2026-76639 represents a separate root-RCE path involving the chat_go AI service and bashrunner. A path-traversal flaw in a knowledge-base upload workflow allowed a file to be written into bashrunner's whitelist directory. bashrunner builds its whitelist at import and executes files based on shell rules that do not consider extensions, enabling root code execution on the Locomotion PC.
Laflamme reproduced the vulnerabilities on four G1 units. Unitree reportedly verified both chains during coordinated disclosure. Laflamme said Unitree patched the cloud account-to-robot ownership check in July 2026, meaning the current cloud-assisted route requires an account bound to the target G1 or the relevant key material already in hand. An exact fixed firmware release has not been verified in any accessible Unitree guidance, leaving G1 EDU owners without a confirmed release target for either vulnerability. Laflamme received $5,000 in total bug bounties for the work.
Unitree's official product page distinguishes the G1 and G1 EDU as separate models; broader applicability of the two vulnerabilities to other Unitree robots remains unconfirmed.
ANALYSIS The chat_go path traversal is notable because it turns the robot's conversational AI service into an attack surface: an AI feature designed for knowledge-base uploads becomes the vector for planting executable files. The absence of a confirmed firmware fix for either CVE leaves operators of deployed G1 EDU units reliant on the partial cloud-side patch as the only documented mitigation.