humanoidversus
Find a robot

Security advisory

Unitree G1 EDU remote code execution through DDS bridge and file upload

The CVE record describes a network-adjacent, unauthenticated code-execution chain affecting G1 EDU. Weaknesses in the DDS bridge, key protection, and file-upload handling can result in root-level execution on the locomotion computer. The severity shown is VulnCheck CNA CVSS 4.0; its record also supplies a CVSS 3.1 score of 8.8.

Records last verified Oct 13, 2026 · Send a correction

CVE IDs
CVE-2026-76639
Class
Remote Code Execution
CVSS / assessor
8.7 · CVSS 4.0 · VulnCheck CNA
Vendor response
Patched (as reported)

Affected models, versions and components

  • Unitree G1 EDU

    CNA: G1 EDU firmware through 1.5.2; researcher-tested: G1 EDU hardware V1.0, firmware packages 1.4.5–1.5.2

    Component: WebRTC–DDS bridge (webrtc_bridge 1.1.1.6), chat_go 1.9.2.73, bashrunner 1.0.3.1; researcher-tested components

Unitree Robotics →

Disclosure and response timeline

The record has one response or remediation date. It does not supply separate dates for every vendor communication and fix.

  1. Public disclosure

    Reported by Olivier Laflamme.

  2. Vendor response / remediation update (as recorded)

    Patched (as reported). Patch status and the September 1 release date are researcher-reported, without an independent retest. Unitree's August 26 response reproduced in the disclosure raises no objection to its content.

  3. Fix

    Separate fix date not recorded

    1.5.5.0 (researcher-reported; not independently verified)

What owners should do

No owner-facing recommendation is recorded in the primary disclosure. Consult the cited advisory and vendor support for guidance on your exact configuration.

Fixed version (as stated): 1.5.5.0 (researcher-reported; not independently verified).

Patch status and the September 1 release date are researcher-reported, without an independent retest. Unitree's August 26 response reproduced in the disclosure raises no objection to its content.

How to read this ledger

We include official CVE records, vendor advisories, CERT/CISA notices and researchers’ own disclosures. CVSS is attributed to its published assessor, including the named CVE Numbering Authority (CNA), with the version from the recorded vector. A CNA score is not an NVD assessment. An unpublished score stays unknown.

Affected versions, variants, component scope and fix qualifications retain the disclosure’s wording. A reported patch is not an independent retest. Disputed findings show the researcher and vendor positions together. We publish no exploit instructions or payloads.

Counts describe curated advisory records; several records may come from one disclosure. Coverage is incomplete and is not a security ranking. An absent record does not establish that a robot has no vulnerabilities.

Evidence

Sources

  1. [s1] CVE-2026-76639 — CVE Program record ↗

    CVE Program / VulnCheck CNA · database · published Aug 27, 2026 · accessed Oct 13, 2026

  2. [s2] UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range ↗

    Olivier Laflamme · other · published Aug 27, 2026 · accessed Oct 13, 2026

  3. [s3] VulnCheck CNA advisory — CVE-2026-76639 ↗

    VulnCheck · other · published Aug 27, 2026 · accessed Oct 13, 2026

  4. [s4] UniBLEed researcher-tested G1 EDU versions and components ↗

    Olivier Laflamme · other · accessed Oct 13, 2026

  5. [s5] Unitree response reproduced in the UniBLEed disclosure ↗

    Unitree correspondence reproduced by Olivier Laflamme · other · accessed Oct 13, 2026

Other advisory records

Trackers

Task evidence →

Source statements, stated autonomy and demonstration conditions.

Deployments →

Customers, tasks, contracts and evidence grades.

Timelines →

Dated maker claims, targets and sourced outcomes.

Policy →

Market access, legislation and standards in context.

How many robots →

Estimates, definitions, capacity and forecasts.