What Happened
Security researcher Olivier Laflamme (known as Boschko) has disclosed two independent root remote code execution chains affecting the Unitree G1 EDU humanoid robot — including a Bluetooth Low Energy (BLE) path that lets an unauthenticated attacker reach root on the robot's Locomotion PC from within radio range, no pairing required. The Locomotion PC runs a real-time Linux kernel with root privileges over motors, cameras, audio, and voice.
Chain #1: CVE-2026-76639 — Network-Adjacent RCE via chat_go/bashrunner
| Attribute | Value |
|---|---|
| CVSS Score | 8.8 (High) |
| Attack Vector | Network-adjacent |
| Impact | Root command execution |
This chain combines three weaknesses:
- An unauthenticated WebRTC-to-DDS bridge on TCP port 9991 provides the initial access point.
- A static AES-128 key, world-readable on the device, facilitates interaction with internal services.
- A path traversal flaw in the
chat_goknowledge-upload API lets an attacker plant a file into thebashrunnerservice's whitelist directory.
Because bashrunner builds its execution whitelist at import time and runs files by shell rules without checking extensions, an attacker can publish DDS control messages over the unauthenticated bridge to restart bashrunner, then execute the planted payload — as root.
Chain #2: CVE-2026-76640 — "UniBLEed" Bluetooth Root RCE
This is the more severe chain: it takes an attacker from Bluetooth range to root on a $20,000 humanoid robot, crossing BLE, Unitree's cloud API, the companion mobile app, and the robot's own firmware.
How it works:
- The BLE attack starts at GATT characteristic
0xFFE2, which accepts writes with only basic WRITE permissions — no BLE pairing needed to talk to the robot. - A plaintext bootstrap request returns a robot-specific AES-128 key wrapped in RSA encryption.
- Unitree's
/device/bindExtDatacloud API can decrypt that RSA-wrapped material for any authenticated Unitree account — the endpoint reportedly never verified that the submitted serial number actually belonged to the requesting account. - With the recovered AES key, an attacker establishes the authenticated BLE state needed for Wi-Fi provisioning, then leverages a separate path traversal in the robot's AI chatbot knowledge base (which leaks the binary's load address) plus a 1,050-byte BSS buffer overflow to corrupt the event loop into calling
system()as root.
Laflamme notes the exploit is wormable: once one G1 is compromised, it can propagate the same exploit to the next G1 within range, indefinitely.
Disclosure and Fix Status
- Unitree patched the cloud account-to-robot ownership check in July 2026, closing the path where any authenticated account could pull another robot's key material.
- Both chains were verified with Unitree during coordinated disclosure, and the key-retrieval flow now checks ownership before returning plaintext key data.
- No confirmed firmware release fixes either CVE outright — Unitree has not published a specific patched firmware version in accessible guidance, so G1 EDU owners currently lack a firm update target.
- The issues were reproduced across four physical G1 robots; Laflamme was awarded $6,700 in combined bug bounties across the two CVEs.
- This research builds on a prior disclosure ("UniPwn") into Unitree BLE/RCE issues, with this new "UniBLEed" work representing an expanded, fully unauthenticated attack chain.
Why This Matters
Humanoid robots are increasingly deployed in research labs, universities, and industrial pilots, often on shared networks or in publicly accessible spaces. A wormable, unauthenticated root exploit reachable over Bluetooth — with no user interaction and no pairing — turns a single compromised unit into a foothold for propagating to every other G1 within radio range. Until Unitree ships a confirmed firmware fix, organizations running G1 EDU units should treat Bluetooth exposure as an active risk and restrict physical/RF proximity to untrusted parties where possible.