A security researcher has uncovered a series of vulnerabilities in the Unitree G1 humanoid robot that could allow an attacker to gain remote root access and potentially compromise other robots within proximity. The researcher, Olivier Laflamme, spent approximately three months investigating the G1 and detailed two distinct vulnerabilities, identified as CVE-2026-76639 and CVE-2026-76640.
The first vulnerability, CVE-2026-76639, resides within the robot's AI chatbot service. This service accepts knowledge uploads with insufficient validation of filenames, making it susceptible to a path traversal attack. An attacker could exploit this by writing an arbitrary file to a trusted directory used by another service, `bashrunner`. By subsequently instructing `bashrunner` to execute the planted file via five DDS messages, an attacker could achieve root-level shell execution without any authentication, provided they have Ethernet access to the robot.
The second, more concerning, vulnerability chain begins with a Bluetooth characteristic that accepts writes without requiring device pairing. An unpaired device can request an encrypted key bootstrap blob from the robot. Unitree's cloud API would then decrypt this blob for any free, logged-in Unitree account, critically failing to verify if the account actually owned the specific robot. This decrypted blob, an AES-128 key, is crucial as it unlocks both the Bluetooth protocol and WebRTC signaling channels.
Once this AES-128 key is obtained, an attacker can authenticate to the robot's Bluetooth handshake and unlock WiFi configuration commands. An oversized WiFi password then triggers a fallback code path in Unitree's configuration script, allowing attacker-controlled text to be inserted directly into a configuration file without proper escaping. This enables the attacker to force the robot to connect to a malicious hotspot they control, eliminating the need for physical access.
Achieving a full root shell from a compromised Wi-Fi connection required exploiting a buffer overflow in the G1’s Bluetooth server. The server utilized a 500-byte buffer without adequate bounds checking, which Laflamme exploited by crafting a 1,050-byte payload to overwrite adjacent memory. This payload was used to create a fake cleanup structure that the program later interpreted as a legitimate function pointer, leading to the execution of an attacker-controlled command with root privileges.
A further challenge was the randomized memory addresses. To ensure the exploit's reliability, Laflamme first leveraged the initial vulnerability (CVE-2026-76639) as an information leak to discover the vulnerable program's memory location, thereby enabling the second exploit to function consistently. This effectively demonstrates how one vulnerability could facilitate the exploitation of another.
A significant concern highlighted by the research is the potential for "wormability." Once a single G1 robot is compromised, it could use the same attack methods to compromise other G1 robots within Bluetooth range, without requiring additional discovery or configuration. While Laflamme's testing involved only two robots in close proximity, the implications for environments with numerous robots, such as warehouses, laboratories, or university campuses, are substantial, raising the possibility of a widespread chain reaction.
Unitree's response to the disclosure has been acknowledged positively. The company implemented an account-to-robot cloud binding ownership check to address the cloud-oracle vulnerability between July 1 and August 6, 2026. This patch prevents unauthorized decryption of the AES-128 key. Unitree also paid out a combined bounty of $5,000 USD for both vulnerability chains ($4,000 for the Bluetooth remote code execution and $1,000 for the chatbot remote code execution). The company's collaboration and prompt verification process were described as close to ideal.
However, the Bluetooth pairing and buffer overflow issues are deeply embedded in the robot's firmware, indicating that these will require more complex and time-consuming fixes compared to the cloud-side ownership check. The researcher emphasized that the attacks did not rely on exotic tools or cutting-edge techniques, underscoring that robot security, even for a $20,000 humanoid robot increasingly used in research and commercial settings, should not be considered a niche problem.
