# Two Root RCE Bugs in Unitree G1 EDU Humanoid Robot — One Reachable Over Bluetooth Without Pairing
## The Threat
Security researcher Olivier Laflamme has published a dual-vulnerability disclosure against the Unitree G1 EDU humanoid robot that grants an attacker full root code execution on the robot's Locomotion PC — through two entirely independent attack chains. One path is network-adjacent, exploiting a path traversal in a service called chat_go to reach a privileged command executor. The other starts over Bluetooth Low Energy and requires no pairing at all to initiate.
The first vulnerability, CVE-2026-76639, chains a path-traversal condition in the robot's chat_go service into bashrunner, a component that — as the name strongly implies — executes shell commands. The result is root execution on the Locomotion PC, the compute unit that controls the robot's movement. No legitimate network access to the robot is required beyond adjacency; the path traversal handles the rest.
The second, CVE-2026-76640, is the more striking of the two. An attacker within Bluetooth range can initiate the bootstrap handshake without pairing. The BLE write path accepts that initial interaction unauthenticated. From there, Laflamme's proof-of-concept exploited what was, until July 2026, a server-side authorization gap in Unitree's cloud service: an authenticated Unitree account could request key material for *any* G1 EDU — not just the one bound to that account. Those recovered keys enable the authenticated BLE state needed for Wi-Fi provisioning operations. A buffer overflow in that provisioning code then yields root on the Locomotion PC. Unitree closed the cloud-side ownership check in July, which breaks that specific proof-of-concept flow, but the BLE-reachable buffer overflow itself remains unpatched.
## Severity and Impact
| CVE | Description | Attack Vector | Auth Required | Privileges Gained | CVSS Score |
|-----|-------------|---------------|---------------|-------------------|------------|
| CVE-2026-76639 | Path traversal in chat_go → bashrunner root RCE | Adjacent network | None | Root | Not yet published |
| CVE-2026-76640 | Unauthenticated BLE bootstrap → buffer overflow root RCE | Bluetooth (adjacent) | None (BLE initiation) | Root | Not yet published |
CVSS scores have not been formally published as of August 27, 2026. Based on the attack characteristics — no authentication, adjacent access, root-level code execution — both vulnerabilities are expected to score in the High to Critical range. Laflamme's disclosure noted CVE-2026-76639 can function as a standalone RCE, and also reused it as one step in the demonstration of the BLE chain, meaning the two issues are independent but composable.
## Affected Products
- Laflamme conducted research on firmware V1.5.2 (upgraded from V1.5.1.1 during testing); V1.5.1.1 is not independently confirmed as affected
- No fixed firmware version has been identified or confirmed by Unitree as of the August 27 disclosure date
Unconfirmed scope:
## Mitigations
No firmware patch has been publicly confirmed. Until Unitree specifies a fixed release, operators should apply the following controls:
chat_go / bashrunner path requires network adjacencychat_go and bashrunner — if these services can be disabled without impacting required operations, do so; confirm with Unitree support which services are required for core locomotion## References
---
## HackWire Analysis
There is something clarifying about a robot that can walk, lift, and now also be owned over Bluetooth by anyone standing nearby. The Unitree G1 EDU is aimed squarely at research institutions — universities, AI labs, robotics programs — which makes the attack surface meaningful. These are not factory-floor machines sealed in a controlled environment. They operate in open labs, shared spaces, and demonstration settings where Bluetooth range is trivially achievable and "network adjacency" describes half the building.
The cloud authorization gap that Unitree quietly patched in July deserves attention: a valid Unitree account could recover cryptographic key material associated with *any* G1 EDU, regardless of ownership. That is not a nuanced edge case — it is a fundamental access control failure that, in a different context, would make headlines on its own. The patch closes the specific proof-of-concept Laflamme documented, but it does nothing for the underlying BLE buffer overflow, which remains exploitable through other means of obtaining the authenticated BLE state.
The broader pattern here is one the embedded and robotics security community has been watching: humanoid robots are arriving faster than their attack surfaces are being evaluated. Unitree has iterated hardware and firmware quickly. That velocity produces capable platforms and also produces bashrunner — a service name that should have triggered a design review before it shipped. The fact that path traversal in a network-adjacent service reaches a root shell executor suggests the security architecture of these systems has not kept pace with the hardware ambition.
For defenders in research institutions: inventory your G1 EDUs now, apply network isolation, and suppress Bluetooth if you do not need it. Do not wait for a firmware release that has no announced date.
— HackWire Editorial
---
## Related Coverage