humanoidversus
Find a robot

Security advisory

Unitree G1 EDU BLE provisioning and buffer handling allow root code execution

The CVE record describes a proximity-based root code-execution chain in G1 EDU BLE and Wi-Fi provisioning components. It combines missing authentication with unsafe input and buffer handling. The severity shown is VulnCheck CNA CVSS 4.0; its record also supplies a CVSS 3.1 score of 7.5.

Records last verified Oct 13, 2026 · Send a correction

CVE IDs
CVE-2026-76640
Class
Remote Code Execution
CVSS / assessor
7.7 · CVSS 4.0 · VulnCheck CNA
Vendor response
Patched (as reported)

Affected models, versions and components

  • Unitree G1 EDU

    CNA: G1 EDU firmware through 1.5.2; researcher-tested: G1 EDU hardware V1.0, firmware packages 1.4.5–1.5.2

    Component: BLE GATT server (btgatt-server in network_manager 2.0.0.14) / Wi-Fi provisioning; researcher-tested components

Unitree Robotics →

Disclosure and response timeline

The record has one response or remediation date. It does not supply separate dates for every vendor communication and fix.

  1. Public disclosure

    Reported by Olivier Laflamme.

  2. Vendor response / remediation update (as recorded)

    Patched (as reported). Patch status and the September 1 release date are researcher-reported, without an independent retest. Unitree's August 26 response reproduced in the disclosure raises no objection to its content. The researcher separately reports an earlier cloud ownership-check fix.

  3. Fix

    Separate fix date not recorded

    1.5.5.0 (researcher-reported; not independently verified)

What owners should do

No owner-facing recommendation is recorded in the primary disclosure. Consult the cited advisory and vendor support for guidance on your exact configuration.

Fixed version (as stated): 1.5.5.0 (researcher-reported; not independently verified).

Patch status and the September 1 release date are researcher-reported, without an independent retest. Unitree's August 26 response reproduced in the disclosure raises no objection to its content. The researcher separately reports an earlier cloud ownership-check fix.

How to read this ledger

We include official CVE records, vendor advisories, CERT/CISA notices and researchers’ own disclosures. CVSS is attributed to its published assessor, including the named CVE Numbering Authority (CNA), with the version from the recorded vector. A CNA score is not an NVD assessment. An unpublished score stays unknown.

Affected versions, variants, component scope and fix qualifications retain the disclosure’s wording. A reported patch is not an independent retest. Disputed findings show the researcher and vendor positions together. We publish no exploit instructions or payloads.

Counts describe curated advisory records; several records may come from one disclosure. Coverage is incomplete and is not a security ranking. An absent record does not establish that a robot has no vulnerabilities.

Evidence

Sources

  1. [s1] CVE-2026-76640 — CVE Program record ↗

    CVE Program / VulnCheck CNA · database · published Aug 27, 2026 · accessed Oct 13, 2026

  2. [s2] UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range ↗

    Olivier Laflamme · other · published Aug 27, 2026 · accessed Oct 13, 2026

  3. [s3] VulnCheck CNA advisory — CVE-2026-76640 ↗

    VulnCheck · other · published Aug 27, 2026 · accessed Oct 13, 2026

  4. [s4] UniBLEed researcher-tested G1 EDU versions and components ↗

    Olivier Laflamme · other · accessed Oct 13, 2026

  5. [s5] Unitree response reproduced in the UniBLEed disclosure ↗

    Unitree correspondence reproduced by Olivier Laflamme · other · accessed Oct 13, 2026

Other advisory records

Trackers

Task evidence →

Source statements, stated autonomy and demonstration conditions.

Deployments →

Customers, tasks, contracts and evidence grades.

Timelines →

Dated maker claims, targets and sourced outcomes.

Policy →

Market access, legislation and standards in context.

How many robots →

Estimates, definitions, capacity and forecasts.