Two root attack chains on Unitree G1 EDU: one via network, one via Bluetooth

On August 27, 2026, researcher Olivier Laflamme published details of two independent exploit chains that allow achieving root code execution on the Locomotion PC of the Unitree G1 EDU humanoid robot. The vulnerabilities, tracked as CVE-2026-76639 and CVE-2026-76640, follow different paths: the first exploits a local network flaw, the second starts from Bluetooth Low Energy proximity and, in its original form, passed through a gap in Unitree's cloud service.

The network-adjacent chain: from chat_go to root

CVE-2026-76639 has a network-adjacent vector: an attacker must be on the same network as the robot. The flaw is a path traversal condition in the chat_go component. By exploiting it, one reaches bashrunner, an executable that allows launching commands with root privileges on the Locomotion PC. The result is independent remote code execution.

The CVE has a CVSS score of 8.8, with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice: no authentication required, no user interaction, complete impact on confidentiality, integrity, and availability. Attack complexity is low once local network access is obtained.

The same path traversal primitive was later reused by Laflamme as a component of the second chain, the Bluetooth one.

The BLE chain: from physical proximity to root via the cloud

CVE-2026-76640 starts from a different premise: physical proximity to the robot. The initial write via Bluetooth Low Energy accepts bootstrap interaction without requiring Bluetooth pairing. The bootstrap material remains protected, but subsequent Wi-Fi provisioning operations demand an authenticated BLE application state. To overcome this step, the researcher exploited a flaw in the Unitree cloud.

During the research, the cloud service accepted a valid Unitree account for a key recovery request without verifying that the account was linked to the robot whose keys were being requested. This allowed obtaining keys associated with someone else's G1 EDU. With the recovered key, the authenticated BLE state was established. At that point the chain reached the Wi-Fi provisioning code, where a buffer overflow produced root execution on the Locomotion PC.

The CVSS score for this CVE is 7.5, with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Complexity is high because it requires multiple steps, but the initial barrier remains physical proximity alone. Propagation testing was limited to two G1 robots in a room.

The partial fix: the cloud has been fixed, the firmware has not

Unitree corrected the cloud account ownership check in July 2026. As of August 27, 2026, the cloud-assisted route requires an account linked to the target G1 or possession of the key material. This change breaks the proof-of-concept of the BLE chain as it was demonstrated.

On the firmware front, however, no corrective release has been verified in Unitree's public advisories. G1 EDU owners do not have a confirmed version target. The update of the test robot to V1.5.2 alone does not prove that the previous V1.5.1.1 is affected. The Hacker News has contacted Unitree to clarify firmware versions, scope of applicability, and remediation status. Any responses will update the article.

Who is exposed and what an owner can do

The product involved is the G1 EDU model, which the official Unitree page distinguishes from the standard G1. Applicability to other Unitree robots is not confirmed. The CVEs concern the Locomotion PC, the component that manages the robot's movement.

Until a verified firmware patch is available, owners can reduce risk by limiting the network exposure of the Locomotion PC, for example by isolating it from the LAN or blocking traffic to chat_go. For the BLE vector, it is useful to disable Bluetooth when not needed and keep the robot in physically controlled areas. It is not known whether the two CVEs have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Two independent vectors, one same consequence

The two chains described by Laflamme share the final goal: root code execution on the Locomotion PC. The network-adjacent vector requires local network access; the BLE one reduces the barrier to physical proximity alone. The cloud gap, now fixed, allowed recovering keys between robots and turned a proximity attack into large-scale credential theft.

The flaws are spread across different components: chat_go, bashrunner, Wi-Fi provisioning, and the cloud service. This makes the overall vulnerability harder to mitigate with a single intervention. For now, the only confirmed fix is on the cloud side. The rest awaits an official response from Unitree.