Critical RCE Flaws Found in Unitree G1 EDU Humanoid Robot
Two root-level remote code execution vulnerabilities were discovered in the Unitree G1 EDU robot, one of which is exploitable over Bluetooth. These flaws could allow attackers to fully compromise the device.
TL;DR
- Researcher Olivier Laflamme found two critical RCE flaws in Unitree G1 EDU robots.
- CVE-2026-76639 allows root RCE via a network-adjacent path involving chat_go and bashrunner.
- CVE-2026-76640 enables root access over Bluetooth Low Energy without authentication.
- Both vulnerabilities grant full control of the robot’s Locomotion PC.
- Organizations using these robots should monitor for patches and restrict network access.
Security researcher Olivier Laflamme has uncovered two high-severity vulnerabilities in the Unitree G1 EDU humanoid robot that allow unauthenticated remote attackers to gain root access. These flaws pose significant risks to organizations deploying the robot in educational or research environments.
One of the vulnerabilities leverages a network-based attack vector through components named chat_go and bashrunner, while the more concerning flaw exploits Bluetooth Low Energy (BLE) to achieve root remote code execution. This means physical proximity may be sufficient for an attacker to take full control of the robot’s core systems.
Vulnerability Details
- CVE-2026-76639 involves a network-adjacent path leading to root RCE via chat_go and bashrunner services.
- CVE-2026-76640 allows root-level access over Bluetooth without requiring authentication.
- Both flaws result in complete compromise of the robot’s Locomotion PC, which controls movement and core functions.
- No user interaction or privileged access is required to exploit either vulnerability.
Impact and Recommendations
- Attackers could gain persistent control over the robot, potentially accessing connected networks or stealing data.
- Organizations using Unitree G1 EDU robots should isolate devices on secure network segments.
- Disable unnecessary Bluetooth interfaces and apply vendor patches as soon as they become available.
- Conduct internal risk assessments to determine exposure if these robots are used in public or shared spaces.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.