Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcherOlivier Laflammehas disclosed two independent root remote code execution (RCE) chains affecting theUnitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC.

The flaws are tracked asCVE-2026-76639andCVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the second beginning from BLE proximity.

An exact fixed firmware release has not been verified in any accessible Unitree guidance, leaving G1 EDU owners without a confirmed release target for either vulnerability.

Laflamme said Unitree patched the cloud account-to-robot ownership check in July 2026, closing the cross-owner arbitrary-G1 path. As of the August 27 disclosure, a G1 owner could still use an account bound to their own robot to recover its Advanced Encryption Standard (AES) key. The underlying BLE issues, a write to0xFFE2that does not require pairing and the BSS buffer overflow, are separate from the cloud fix.

Laflamme published the research on August 27, 2026, describing the two issues as separate root-RCE paths. The research timeline shows Laflamme upgraded the test robot to V1.5.2, but that sequence does not by itself establish V1.5.1.1 as affected.

In histechnical disclosure, Laflamme said CVE-2026-76639 uses a path-traversal condition in chat_go to reach bashrunner. Execution through bashrunner results in root code execution on the Locomotion PC.

Laflamme described CVE-2026-76639 as an independent RCE, although he reused it as one disclosure primitive while demonstrating the separate BLE chain tracked as CVE-2026-76640.

For CVE-2026-76640, the initial BLE write path accepts the bootstrap interaction without Bluetooth pairing. The bootstrap material itself remains protected, and the later Wi-Fi provisioning operations require the application's authenticated BLE state.

During Laflamme's research, Unitree's cloud service accepted a valid Unitree account for the key-recovery request but did not verify that the account owned the supplied robot.

That authorization gap allowed the account to recover key material associated with another G1 EDU. The recovered key could then be used to establish the authenticated BLE state required by the Wi-Fi provisioning operations.

The Wi-Fi heredoc injection inwpa_connect.shthen forced the G1 onto the attacker's hotspot, providing a network pivot. Root execution came from a separate buffer overflow inbtgatt-server, where a 1,050-byte write through the 500-bytewifi_ssidBSS buffer corrupted the event loop into callingsystem()as root on the Locomotion PC.

Laflamme limited his propagation test to two G1 robots in one room. He said in the August 27 disclosure that the cloud authorization fix breaks that exact proof-of-concept flow.

Unitree'sofficial product pagedistinguishes the G1 and G1 EDU as separate models, while broader applicability of the two new vulnerabilities to other Unitree robots remains unconfirmed.

The Hacker News has reached out to Unitree to confirm the fixed firmware versions, the affected product scope, and the current remediation status, and will update the story with any response.

Corrected on September 2, 2026: An earlier version incorrectly located the buffer overflow in the Wi-Fi provisioning code, embedded a non-BLE demonstration where the Bluetooth Low Energy chain was discussed, and did not fully describe the scope of Unitree's cloud authorization fix; the overflow is inbtgatt-server, and the video and patch-status description have been corrected.