Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth
A security researcher discovered two separate root remote code execution (RCE) vulnerabilities in Unitree's G1 and G1 EDU humanoid robots. One vulnerability, accessible via Bluetooth, allows attackers to gain root access without pairing, while the other involves a network-adjacent path. Unitree has addressed the cloud account-to-robot ownership check, but a confirmed firmware update is still pending.
Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 and G1 EDU humanoid robots. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640. CVE-2026-76639 uses a path-traversal condition in chat_go to reach bashrunner, resulting in root code execution on the Locomotion PC. CVE-2026-76640, on the other hand, begins from BLE proximity and accepts the bootstrap interaction without Bluetooth pairing. The bootstrap material remains protected, and later Wi-Fi provisioning operations require the application's authenticated BLE state.
Unitree’s cloud service accepted a valid Unitree account for the key-recovery request, but did not verify that the account owned the supplied robot. This authorization gap allowed the account to recover key material associated with another G1 EDU. The recovered key could then be used to establish the authenticated BLE state required by the Wi-Fi provisioning operations, ultimately reaching the Wi-Fi provisioning code and producing root execution on the Locomotion PC.
Laflamme limited his propagation test to two G1 robots in one room. He noted that Unitree’s cloud authorization fix breaks the exact proof-of-concept flow. Unitree distinguishes the G1 and G1 EDU as separate models, but the broader applicability of these vulnerabilities to other Unitree robots remains unconfirmed. The Hacker News is awaiting a response from Unitree for confirmation on fixed firmware versions and remediation status.