$20,000 Humanoid Robot, $0 Authentication: Bluetooth to Root
Researchers disclosed two independent routes to root code execution on Unitree’s G1 EDU humanoid robot. One begins on the local network. The other starts within Bluetooth range. Both reach a privileged computer that helps control a machine designed to move through the physical world.
The findings affect a research and education platform that can cost around $20,000 or more depending on configuration. They are not evidence that attackers have taken control of deployed robots, but they show that ordinary wireless and network trust assumptions can cross into a physical device.
The network path: unauthenticated requests to root
CVE-2026-76639 affects Unitree G1 EDU firmware through version 1.5.2. The chain begins with an unauthenticated WebRTC-to-DDS bridge listening on TCP port 9991.
The researchers found a static AES-128 key that was world-readable on the device. They then used path traversal in a knowledge-upload function exposed by the chat_go component to write attacker-controlled content outside the intended directory.
A privileged bashrunner service completed the chain. Together, the weaknesses allowed a network-adjacent attacker to execute commands as root on the robot’s locomotion computer.
The Bluetooth path: proximity becomes privileged access
CVE-2026-76640 starts from Bluetooth Low Energy range. The vulnerable GATT and Wi-Fi provisioning stack can be abused to reach code execution on the same privileged computer.
Bluetooth limits distance, but it does not make the flaw harmless. Robots may operate in laboratories, classrooms, demonstrations and shared facilities where an untrusted person can approach the device without joining the organisation’s Wi-Fi network.
Why root on a robot is different
Root access can expose credentials, sensor data, software and connected networks. On a mobile robot, it may also influence components that contribute to movement and physical interaction. The published research establishes the software boundary failure, not a catalogue of proven safety outcomes.
That distinction should guide responsible response. Defenders should take the root compromise seriously without claiming that every possible physical consequence has been demonstrated.
Patch uncertainty increases the operational burden
The primary disclosure did not identify a fixed firmware release at the time of publication. Owners therefore need to check Unitree’s current support guidance directly and should not assume that an available update contains a complete fix unless the vendor says so.
Where an immediate patch is unavailable, containment has to reduce reachability. The network bridge should not be exposed to untrusted segments. Bluetooth provisioning should be disabled when it is not needed, if the product supports that configuration.
What G1 EDU owners should do
- Inventory every G1 EDU and record its exact firmware version and network placement.
- Block untrusted access to TCP port 9991 and isolate the robot from general user networks.
- Restrict outbound access so a compromised robot cannot become a bridge to sensitive services.
- Disable Bluetooth or Wi-Fi provisioning outside controlled setup periods where possible.
- Review root-level services, shell history, uploaded knowledge files and unexpected configuration changes.
- Rotate credentials stored on or used by the robot if compromise cannot be ruled out.
- Contact Unitree for confirmed fixed-version guidance and document the response.
- Supervise operation until the software state and control paths are trusted.
The BlackTree view
The important lesson is not that robots are uniquely insecure. It is that familiar application flaws now sit inside machines with motors, sensors and physical reach.
CVE-2026-76639 turns an unauthenticated network service into root. CVE-2026-76640 turns nearby Bluetooth access into the same result. Product teams need to treat every provisioning bridge, upload handler and helper service as part of the robot’s safety boundary, not merely its software stack.
Sources
- Primary researcher disclosure: Unitree G1 EDU BLE and network remote-code-execution chains, published 27 August 2026. The page provides a date but no publication time.
- The Hacker News: two Unitree G1 EDU humanoid robot flaws enable remote code execution, published in August 2026. Consult the source page for its displayed publication time.
