Unitree G1 Humanoid Robot Flaws Allow Unauthenticated Root RCE Over Bluetooth

Security researcher Boschko has revealed two vulnerabilities in Unitree’s G1 humanoid robot that can be exploited to achieve unauthenticated remote code execution (RCE) from nearby devices via Bluetooth Low Energy (BLE).

This research, referred to as UniBLEed, indicates that the attack can compromise the robot’s Locomotion PC, the component responsible for essential functions, without requiring any BLE pairing.

Unitree G1 Humanoid Robot Flaws

The vulnerabilities have been assigned the identifiers CVE-2026-76639 and CVE-2026-76640. The latter refers specifically to the Bluetooth-related chain of exploits.

A GATT characteristic, identified as 0xFFE2, accepted writes only with basic WRITE permission, allowing a nearby device to interact without needing to authenticate or pair.

A cleartext bootstrap command returned an AES-128 key specific to the robot, encapsulated inside an RSA-encrypted response.

Typically, the key-wrapping process should keep it secure. However, the researcher found that Unitree’s cloud API endpoint at /device/bindExtData would decrypt the data and return the plaintext key to any authenticated Unitree account.

Alarmingly, the API did not verify ownership of the serial number submitted with the request, meaning that merely being near the target was enough to recover the unique secret associated with the robot’s BLE version 3 setup and Wi-Fi configuration.

Once the researcher Boschko obtained this key, they could access protected BLE operations. A 121-byte pre-shared key was used to trigger an insecure Wi-Fi fallback in a script called wpa_connect.sh.

Because attacker-controlled data is inserted into an unquoted heredoc, the resulting wpa_supplicant configuration could be manipulated, allowing the robot to connect to an attacker-controlled hotspot.

The final phase of the attack targeted btgatt-server, a Bluetooth service that runs with root privileges. The report explains how a 1,050-byte input was written through a 500-byte wifi_ssid buffer.

By exploiting this overflow, combined with an information leak that undermined address randomization, the exploit altered the event-loop cleanup state, causing the system() command to execute an attacker-defined command as root. Although the Bluetooth service crashed afterward, the background shell remained active, according to the researcher.

CVE-2026-76639 represents a separate path to root RCE involving the G1’s chat_go AI service and bashrunner. A path traversal vulnerability in the knowledge-base upload workflow allowed a file to be written into bashrunner’s whitelist directory.

Because bashrunner builds its whitelist at import and executes files based on shell rules that do not consider extensions, this combination enabled execution as root. In the context of the BLE chain, this issue also served as a means of disclosing addresses within the Bluetooth daemon.

The implications of these vulnerabilities extend beyond mere control of the robot. The report states that the Locomotion PC runs on a real-time Linux kernel and executes services with root privileges, managing key functions such as motors, cameras, audio, and voice.

The researcher also reported having access to device secrets and credentials following the compromise. This underscores the necessity for strict separation between mobile provisioning, cloud account authorization, local radio interfaces, and safety-critical control services.

Unitree has reportedly verified both attack chains during a coordinated disclosure and has added a check to ensure that accounts match the robot ownership before returning the AES key.

The researcher noted that patches addressed most, if not all, of the reported issues, but cautioned that the findings reflect the tested builds rather than the current state of the G1.

The bugs were reproduced on four G1 units, and the researcher received a total of $5,000 in bounties for their work. Operators are advised to apply Unitree updates, limit physical and Bluetooth proximity to deployed robots, review account access, and treat affected systems as potentially insecure until remediation is confirmed.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC