Security advisories ledger
Humanoid robot security advisories
Public disclosures with documented model and component scope, attributed severity and vendor responses. Fixes retain the source’s qualifications.
Records last verified Oct 13, 2026 · Send a correction
How to read this ledger
We include official CVE records, vendor advisories, CERT/CISA notices and researchers’ own disclosures. CVSS is attributed to its published assessor, including the named CVE Numbering Authority (CNA), with the version from the recorded vector. A CNA score is not an NVD assessment. An unpublished score stays unknown.
Affected versions, variants, component scope and fix qualifications retain the disclosure’s wording. A reported patch is not an independent retest. Disputed findings show the researcher and vendor positions together. We publish no exploit instructions or payloads.
Counts describe curated advisory records; several records may come from one disclosure. Coverage is incomplete and is not a security ranking. An absent record does not establish that a robot has no vulnerabilities.
| Aug 27, 2026 | CVE-2026-76640 |
| Remote Code Execution | 7.7 · CVSS 4.0 · VulnCheck CNA | Patched (as reported) Patch status and the September 1 release date are researcher-reported, without an independent retest. Unitree's August 26 response reproduced in the disclosure raises no objection to its content. The researcher separately reports an earlier cloud ownership-check fix. | 1.5.5.0 (researcher-reported; not independently verified) | ||
| Aug 27, 2026 | CVE-2026-76639 |
| Remote Code Execution | 8.7 · CVSS 4.0 · VulnCheck CNA | Patched (as reported) Patch status and the September 1 release date are researcher-reported, without an independent retest. Unitree's August 26 response reproduced in the disclosure raises no objection to its content. | 1.5.5.0 (researcher-reported; not independently verified) | ||
| Feb 27, 2026 | CVE-2026-1442 |
| Hardcoded Credentials | 7.8 · CVSS 3.1 · Austin Hackers Anonymous CNA | Unknown The CNA and researcher say the vendor was not notified. No vendor response or fixed UPK format is identified in these disclosures. | No fixed version identified | ||
| Sep 20, 2025 | CVE-2025-60017 |
| Command Injection | 8.2 · CVSS 3.1 · MITRE CNA | Acknowledged Unitree reported distributing OTA fixes; no CVE-specific fixed release is identified. | No fixed version identified | ||
| Sep 20, 2025 | CVE-2025-60251 |
| Authentication Bypass | 5.0 · CVSS 3.1 · MITRE CNA | Acknowledged Unitree reported distributing OTA fixes; no CVE-specific fixed release is identified. | No fixed version identified | ||
| Sep 20, 2025 | CVE-2025-60250 |
| Hardcoded Credentials | 4.7 · CVSS 3.1 · MITRE CNA | Acknowledged Unitree reported distributing OTA fixes; no CVE-specific fixed release is identified. | No fixed version identified | ||
| Sep 20, 2025 | CVE-2025-35027 |
| Command Injection | 7.3 · CVSS 3.1 · Austin Hackers Anonymous CNA | Acknowledged Unitree reported distributing OTA fixes on September 29. AHA reported on October 7 that recent updates did not address this CVE. No fixed version is identified. | No fixed version identified | ||
| Sep 17, 2025 | Unitree G1 telemetry privacy findings disputed by the manufacturer The researchers report G1 telemetry transmissions of sensor and service-state data without explicit operator notice or consent. Unitree states that internet access requires user configuration and authorization, and that connected robots may send serial-number and health-state data. Unitree denies collecting private or sensitive data without authorization. | No CVE recorded |
| Privacy | No published CVSS | Disputed Unitree disputes unauthorized private or sensitive data collection. No fixed release is identified. | No fixed version identified |
Trackers
Task evidence →
Source statements, stated autonomy and demonstration conditions.
Deployments →
Customers, tasks, contracts and evidence grades.
Timelines →
Dated maker claims, targets and sourced outcomes.
Policy →
Market access, legislation and standards in context.
How many robots →
Estimates, definitions, capacity and forecasts.