Two root RCE flaws (CVE-2026-76639/76640) disclosed in Unitree G1 EDU
S1 · 27 Aug 2026 · Unitree
Record
| Company | Unitree |
| Industry | Humanoid robots |
| Type(s) | cyber |
| Date | 27 Aug 2026 (day precision) |
| Time of day | not documented |
| Location | no physical site (recall / fleet-wide / aggregate record) |
| Severity | (near-miss / disclosed vulnerability) |
| Scale | fleet-wide (G1 EDU model) |
| Confidence | high |
| Verified flag | Cited source on file; not independently re-verified |
Summary
A security researcher disclosed two chained remote-code-execution vulnerabilities in the Unitree G1 EDU humanoid -- one network-adjacent via chat_go/bashrunner, one via Bluetooth proximity plus a Wi-Fi provisioning buffer overflow -- together allowing unauthenticated root access to any G1 within Bluetooth range, with no confirmed fixed firmware publicly verified at disclosure.
Primary source
Publisher: The Hacker News · Retrieved: 2026-09-16
Supporting source rows (1)
| Date | Supporting source row | Publisher | Link |
|---|---|---|---|
| 27 Aug 2026 | Two root RCE flaws (CVE-2026-76639/76640) disclosed in Unitree G1 EDU | The Hacker News | The Hacker News |
Unitree other incidents timeline
Humanoid robots context
cyber context
Unitree industry position
Related incidents
Other Unitree entries
- 07 Sep 2026 - Unitree humanoid unexpectedly lunges at engineer and kicks remote control from his hand during test
- ~Jul 2026 - FCC bars new Unitree robot models from US import/sale over backdoor concerns
- ~Dec 2025 - Unitree G1 accidentally kicks its own teleoperator during motion-mirroring demo
- ~Oct 2025 - Unauthenticated RCE flaws (CVE-2026-27509, CVE-2026-27510) found in Unitree Go2
- ~Sep 2025 - UniPwn wormable Bluetooth exploit roots Unitree Go2, B2, G1 and H1
- not documented - Unitree G1 robot kicks child in stomach during Xinjiang demo
- not documented - Backdoor (CVE-2025-2894) found in Unitree Go1 robot firmware
- not documented - Unitree H1 humanoid flails violently and nearly injures two engineers during test
Report a correction
Also from Critical Systems Analysis: CSA - functional safety engineering · Company directory · FSTalent - functional safety jobs