Two Critical Root RCE Vulnerabilities Discovered in Unitree G1 EDU Humanoid Robot
Security researcher Olivier Laflamme has disclosed two distinct root remote code execution (RCE) vulnerabilities affecting the Unitree G1 EDU humanoid robot. One flaw can be exploited over Bluetooth Low Energy (BLE) to achieve root access on the robot's Locomotion PC, raising concerns about the security of connected robotics platforms.
What happened
Olivier Laflamme publicly revealed two separate root remote code execution chains that impact the Unitree G1 EDU robot. The first vulnerability, identified as CVE-2026-76639, involves a network-adjacent attack vector leveraging components named chat_go and bashrunner. The second, CVE-2026-76640, involves a Bluetooth Low Energy (BLE) interface allowing remote root access on the robot’s Locomotion PC.
These chains are independent, meaning they represent separate exploit paths that can be used individually to gain full control of the system. The disclosure highlights critical risks within the robot’s software stack, particularly where network and BLE interfaces are exposed.
Why it matters
The Unitree G1 EDU humanoid robot is a programmable platform likely used in educational and research environments, making these vulnerabilities significant as they expose devices to full compromise remotely. The ability to achieve root-level access remotely through both network-adjacent and Bluetooth attack vectors illustrates the broad attack surface present in modern robotic systems.
The flaws underline the increasing cybersecurity challenges in robotics, where adversaries gaining control could manipulate robot functions or compromise connected infrastructures. Given the growing deployment of such robots, these vulnerabilities could have implications for safety, privacy, and operational reliability.
What security teams should do
Organizations and teams utilizing the Unitree G1 EDU should promptly review security advisories and apply any available firmware or software updates from the vendor addressing CVE-2026-76639 and CVE-2026-76640. It is advisable to limit exposure of Bluetooth Low Energy interfaces and network services involved with chat_go and bashrunner, especially in untrusted environments.
Monitoring network and Bluetooth activity for anomalous patterns related to these components could help detect exploitation attempts. Until patches are applied, isolating vulnerable robots from external networks may reduce risk.
Key technical details
CVE-2026-76639 refers to a root remote code execution path accessible via a network-adjacent mechanism involving the components named chat_go and bashrunner on the Unitree G1 EDU robot. This implies an attacker can trigger command execution remotely to gain root privileges.
CVE-2026-76640 describes a separate root RCE vulnerability exploitable over Bluetooth Low Energy (BLE), targeting the robot’s Locomotion PC subsystem. Achieving root through BLE indicates attackers could bypass physical connection requirements and leverage wireless attack vectors to compromise the robot.
Affected organizations/products
The vulnerabilities specifically affect the Unitree G1 EDU humanoid robot platform. The disclosed CVEs impact the robot’s Locomotion PC and related software components accessible via network or Bluetooth interfaces.
Source attribution
https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html
