Unitree G1 EDU ‘UniBLEed’ flaws could give nearby attackers root control

The August 2026 “UniBLEed” disclosure described two separate attack chains affecting Unitree G1 EDU firmware through version 1.5.2. One begins with an unauthenticated attacker in Bluetooth range; the other uses network-adjacent services and the robot’s chat_go knowledge-base feature. Both chains were described as capable of reaching root on the robot’s Locomotion PC. 158

That distinction matters. The reported impact extends beyond a compromised app or Bluetooth session: the Locomotion PC supports safety-relevant robot functions, including motors, cameras, audio and voice capabilities. 513

CVE-2026-76640: the BLE-to-root chain

The BLE vulnerability is the more unusual of the two because it does not require an attacker to begin with access to the robot’s local network. Reporting describes an attacker in close Bluetooth range interacting with exposed GATT functionality without pairing or robot credentials. 5813

The reported chain involved several weaknesses working together:

• A Unitree cloud endpoint allegedly allowed a free account to recover a G1’s AES-128 key without adequately checking whether that account owned the target robot. 811
• An attacker could use that access to reach protected BLE operations, inject a pre-shared key and invoke a fallback Wi-Fi-provisioning flow. 811
• Unsafe handling of provisioning data—including an unquoted heredoc variable—could then be combined with flaws in the BLE and Wi-Fi provisioning stack to reach arbitrary command execution as root. 511

Public vulnerability descriptions also report a buffer-overflow component in the SSID-processing path. The overflow could corrupt an adjacent function-pointer dispatch entry, which was later used to invoke attacker-controlled data through system() with root privileges. 35

Why the proximity requirement matters

An attacker would need to be physically close enough to communicate over Bluetooth, but would not necessarily need prior credentials or pairing. That changes the risk profile for robots used in public demonstrations, laboratories, warehouses or shared facilities.

The research also raised a potential worm-like propagation scenario: a compromised G1 could theoretically scan for and target other vulnerable G1 units nearby. That is a capability implication of the attack chain, not evidence that a worm was deployed in the wild. 58

The concern is reinforced by earlier reporting on related Unitree firmware, which documented command injection through malicious Wi-Fi configuration data processed after a BLE provisioning interaction.

CVE-2026-76639: the separate chat_go route

CVE-2026-76639 uses a different entry point. The NVD describes G1 EDU firmware through 1.5.2 as vulnerable to an unauthenticated, network-adjacent root-RCE chain involving three weaknesses: an exposed WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with overly permissive permissions, and path traversal in the chat_go knowledge-upload API. 1

At a high level, the path-traversal flaw could let an attacker place a malicious file in a directory allow-listed by bashrunner. The service would then execute the file as root, turning an unsafe file-placement bug into code execution. 14

This route does not depend on the attacker being next to the robot over Bluetooth. Its practical exposure instead depends on how the robot’s network-adjacent services are reachable and whether untrusted devices can communicate with them.

What a successful compromise could expose

Root access on the Locomotion PC could give an attacker control over software connected to core robot functions. Reporting identifies motors and locomotion, cameras, microphones, audio playback and voice-related features as relevant capabilities. 513

That creates both cybersecurity and physical-safety implications. A compromised robot could potentially be used for surveillance, unauthorized audio or speech, service disruption or unsafe movement. The available reporting establishes the sensitivity of the affected systems, but it does not establish that any particular G1 was exploited or that a dangerous real-world incident occurred.

Unitree’s response—and what remains unclear

Public reporting says Unitree validated the findings and released patches. 6 Other reporting describes an account-to-robot ownership check added in July 2026. 12 However, the supplied evidence does not provide a vendor advisory that maps each CVE to a specific fixed G1 EDU firmware version.

The affected range documented in the CVE material is firmware through 1.5.2. 15 An exact release that definitively remediates every element of both chains has not been independently verified in the available guidance. 8

For that reason, operators should not assume that an unspecified “latest” update resolves both vulnerabilities without checking the installed version and obtaining confirmation from Unitree.

Recommended steps for G1 EDU operators

1. Confirm the fix with Unitree. Ask for the exact firmware version or versions that address both CVE-2026-76639 and CVE-2026-76640, then verify the version installed on each robot.
2. Reduce physical exposure. Until remediation is confirmed, keep affected robots away from untrusted people and other vulnerable G1 units, and disable BLE provisioning where that is operationally practical.
3. Segment the robot’s network. Place G1 systems on isolated, access-controlled networks and block unnecessary inbound access to management, WebRTC/DDS and provisioning services.
4. Restrict file-upload functionality. Disable or limit chat_go knowledge-base uploads where possible, and review bashrunner allow-listed directories and service files for unexpected changes.
5. Investigate suspected exposure. Treat an unexplained compromise as a possible root-level incident: rotate relevant credentials and keys, inspect logs and filesystem changes, and reimage the robot from a trusted vendor source if necessary.

The central lesson from UniBLEed is that robot security depends on the entire connected control stack. A BLE interface, cloud authorization check, provisioning script or AI-related upload feature can become a path to the system that controls the physical machine when authentication boundaries and execution privileges are not enforced consistently.