Security Vulnerabilities Discovered in Unitree G1 EDU Robots

Olivier Laflamme, a security researcher, has disclosed two serious security vulnerabilities in the Unitree G1 EDU robots. These vulnerabilities enable remote code execution (RCE) and affect both the network and Bluetooth communication of the robot. The vulnerabilities are registered under the CVE IDs CVE-2026-76639 and CVE-2026-76640. The first vulnerability, CVE-2026-76639, concerns a network-adjacent path that can be exploited through the components chat_go and bashrunner. This flaw allows attackers to access the robot over the network and potentially execute malicious code.

The exact technical exploitation of this vulnerability has been detailed by Laflamme. The second vulnerability, CVE-2026-76640, opens an attack vector via Bluetooth Low Energy (BLE). This flaw allows direct access to the robot's locomotion PC, which could lead to a complete takeover of the device. The ability to access critical systems via BLE poses a significant security risk. Unitree Robotics, the manufacturer of the G1 EDU robots, has not yet issued an official statement regarding the discovered vulnerabilities.

However, security researchers recommend that affected systems be promptly reviewed and appropriate security measures be implemented to prevent unauthorized access. The discovery of these vulnerabilities raises questions about the overall security of robotic systems, particularly in educational institutions where such devices are frequently used. The possibility that attackers can access robots through everyday communication protocols like Bluetooth and network connections is alarming. The vulnerabilities could also impact the development of future robotic systems. Manufacturers may be compelled to rethink their security architectures and implement more robust protective measures to avoid similar vulnerabilities.

The relevance of security updates and patches is becoming increasingly important in this context. The vulnerabilities were discovered last week, and the details were published in a blog post by Laflamme. Security researchers and IT experts are urged to analyze the information and take appropriate measures to ensure the security of the systems. The CVE IDs CVE-2026-76639 and CVE-2026-76640 are now listed in security databases, meaning they are being monitored by security teams worldwide. The exact number of affected devices is currently unknown; however, it is estimated that thousands of units are in use in educational institutions and research facilities worldwide.

Security vulnerabilities could also have legal consequences for Unitree Robotics, especially if incidents occur that are attributable to these flaws. The responsibility for the security of robotic systems lies with both manufacturers and users, who must ensure that their devices are regularly updated. The discovery of these vulnerabilities underscores the need for continuous monitoring and improvement of security standards in robotics. Experts warn that inadequate security measures in robotics can lead to serious security incidents that pose both physical and digital risks. The vulnerabilities were made public on August 31, 2026, and it is expected that Unitree Robotics will soon respond to the findings.