Two critical security vulnerabilities in Unitree's G1 EDU humanoid robot allow attackers to gain complete control of the machine remotely, with one flaw requiring only Bluetooth proximity and no pairing required. Security researcher Olivier Laflamme disclosed the flaws on August 27, 2026, tracked as CVE-2026-76639 and CVE-2026-76640, revealing separate attack paths that both lead to root-level access on the robot's Locomotion PC.

How Do These Vulnerabilities Actually Work?

The two vulnerabilities represent distinct attack chains that expose different layers of the G1 EDU's security architecture. The first vulnerability, CVE-2026-76639, exploits a path-traversal flaw in a component called chat_go that allows an attacker to reach bashrunner, a system utility that executes commands with root privileges on the Locomotion PC. The second vulnerability, CVE-2026-76640, is more concerning because it starts from Bluetooth Low Energy (BLE) proximity and doesn't require the attacker to have already paired with the robot.

The Bluetooth attack chain is particularly troubling because it chains together multiple weaknesses in the robot's design. An attacker can write to a specific Bluetooth register (0xFFE2) without pairing, then exploit a buffer overflow in the btgatt-server component. When an attacker sends a 1,050-byte payload through the Bluetooth connection to a buffer designed to hold only 500 bytes of Wi-Fi network names, it corrupts the robot's event loop and forces it to execute arbitrary commands as root.

What Makes This Attack Chain So Dangerous?

The real danger lies in how these vulnerabilities can be chained together to completely compromise a G1 EDU robot. During Laflamme's research, he discovered that Unitree's cloud service had an authorization gap: when a user requested to recover encryption keys for a robot, the cloud service accepted any valid Unitree account without verifying that the account actually owned that specific robot. This meant an attacker could use their own account to recover key material from someone else's G1 EDU.

Once an attacker obtained the encryption keys through this cloud authorization flaw, they could establish an authenticated Bluetooth connection to the target robot. From there, they could exploit the Wi-Fi provisioning code to inject commands that force the robot onto an attacker-controlled hotspot. The final step involves the buffer overflow in btgatt-server, which corrupts the robot's event loop and executes system commands with root privileges.

What Steps Should G1 EDU Owners Take?

• Check for Firmware Updates: Unitree patched the cloud account-to-robot ownership check in July 2026, but as of the August 27 disclosure, no confirmed fixed firmware version had been publicly identified for either vulnerability, leaving owners without a clear upgrade path.
• Limit Bluetooth Exposure: Since one vulnerability requires only Bluetooth proximity, consider disabling Bluetooth when the robot is not in active use or keeping it in areas where unauthorized Bluetooth devices cannot easily connect.
• Monitor for Official Guidance: Unitree has not yet provided clear remediation instructions, so owners should regularly check the company's official product pages and security advisories for patched firmware versions.
• Isolate Network Access: Keep G1 EDU robots on isolated or monitored networks to detect unusual Wi-Fi provisioning attempts or suspicious cloud account activity.

Laflamme limited his proof-of-concept testing to two G1 robots in a single room, but the underlying vulnerabilities suggest that any G1 EDU within Bluetooth range could potentially be compromised. The researcher noted that Unitree's cloud authorization fix breaks the exact proof-of-concept flow he demonstrated, but the underlying Bluetooth and buffer overflow issues remain separate problems that still need to be addressed.

The disclosure raises important questions about security practices in the rapidly growing humanoid robotics industry. As companies like Unitree race to bring robots to market and prepare for public offerings, the security of these machines becomes increasingly critical. A compromised humanoid robot could potentially be used to gather sensitive information, disrupt operations, or cause physical harm depending on its deployment environment.

Unitree's official product page distinguishes between the G1 and G1 EDU models, but the broader applicability of these vulnerabilities to other Unitree robots remains unconfirmed. The Hacker News reached out to Unitree for confirmation of fixed firmware versions, affected product scope, and current remediation status, but as of the article's publication, no official response had been provided.