Unitree G1 EDU Humanoid: Two RCE Chains to Root, One Over Bluetooth

Security researcher Olivier Laflamme published a write-up on August 27, 2026 describing two independent chains of remote code execution that yield root privileges on the Unitree G1 EDU humanoid robot. Both vulnerabilities have been assigned the identifiers CVE-2026-76639 and CVE-2026-76640.

The First Path: Directory Traversal

CVE-2026-76639 relies on a path traversal vulnerability in the chat_go component, through which the attack reaches bashrunner. Executing code via bashrunner results in running with root privileges on the so-called Locomotion PC — the computer responsible for the robot's movement. Laflamme describes this vulnerability as standalone, although he used it as one of the supporting primitives when demonstrating the second, more complex chain.

The Second Path: From Bluetooth to Root

CVE-2026-76640 begins with Bluetooth Low Energy proximity. The initial BLE write accepts a bootstrap interaction without device pairing. The bootstrap material itself remains protected, and the subsequent Wi-Fi setup requires an authenticated BLE state from the app.

This is where Unitree's cloud service comes into play. At the time of the research, it accepted a key-recovery request from any valid Unitree account without verifying whether the specified robot actually belonged to that account. This authorization gap made it possible to obtain the key material of someone else's G1 EDU, and then use it to establish that very authenticated BLE state. From there, the chain reached the Wi-Fi setup code, where a buffer overflow again yielded code execution with root privileges.

The researcher limited his test of the attack's spread to two robots in the same room.

What About the Fixes

According to Laflamme, Unitree closed precisely the check on a robot's ownership by an account in the cloud back in July 2026 — and this fix breaks the specific proof-of-concept the author demonstrated. However, the current cloud route still requires either an account bound to the target G1 or key material already in hand.

At the same time, the exact firmware version that resolves the vulnerabilities is confirmed nowhere in Unitree's available materials, so G1 EDU owners are left without a clear reference point for updating. The test robot was updated to version V1.5.2 during the research, but that in itself does not prove that earlier builds are vulnerable.

On its own page, Unitree distinguishes between the G1 and G1 EDU models, and the applicability of the new vulnerabilities to the company's other robots has not yet been confirmed. The Hacker News reached out to the manufacturer for a list of affected versions and the status of the fixes.

Source: The Hacker News