Unitree G1 Flaws Enable Root Bluetooth Code Execution
Boschko disclosed two UniBLEed vulnerability chains affecting Unitree G1 humanoid robots on August 27, 2026, including a Bluetooth Low Energy route to unauthenticated root remote code execution from nearby devices. Mallory.ai reports that the BLE chain can alter Wi-Fi settings and ultimately execute commands as root on the robot's locomotion PC. The reported issues are tracked as CVE-2026-76639 and CVE-2026-76640.
Security researcher Boschko has disclosed two vulnerability chains, collectively called UniBLEed, that can provide unauthenticated root-level remote code execution on Unitree G1 humanoid robots. The Bluetooth Low Energy (BLE) chain permits an attacker within radio range to compromise the robot's locomotion PC, according to reporting indexed by IT Security News and a technical summary from Mallory.ai.
Mallory.ai identifies the issues as CVE-2026-76639 and CVE-2026-76640. The former affects G1 EDU firmware through version 1.5.2 and combines an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a world-readable AES-128 key, and path traversal in the chat_go knowledge-upload API. According to Mallory.ai, an attacker can use that chain to restart the bashrunner service, place a malicious script in its execution path, and obtain root execution on the locomotion PC.
Bluetooth and cloud key recovery chain
The second chain, CVE-2026-76640, begins with an unpaired BLE characteristic that Mallory.ai reports can be written by a nearby attacker. The reported attack sequence includes:
- •Recovery of the robot's AES-128 key through an improperly authorized Unitree cloud decryption endpoint.
- •Modification of Wi-Fi settings through the BLE-accessible interface.
- •Exploitation of a buffer overflow in btgatt-server to execute commands with root privileges.
The technical summary characterizes the BLE route as potentially wormable because a compromised robot could target other nearby G1 units. That outcome is reported as a capability of the disclosed chain, not as evidence of confirmed in-the-wild propagation.
Remediation status
Mallory.ai reports that Unitree validated the BLE RCE chain on June 1 and paid Boschko a total $5,000 bounty on August 6, including $4,000 for the BLE RCE report and $1,000 for the chat_go RCE. The same source reports that Unitree added an account-to-robot ownership binding check to its cloud key-recovery process in July 2026, while patches for other reported issues were either available or under development.
For robotics engineers, the disclosure illustrates how physical-proximity interfaces can become an entry point to safety-relevant computing systems when BLE authorization, cloud-backed key handling, network provisioning, and privileged local services are chained together. In comparable autonomous-system incidents, effective remediation typically requires evaluating the full trust path rather than treating a radio interface, cloud endpoint, or local daemon as an isolated component.
Key Points
- 1Mallory.ai reports two chained flaws can grant unauthenticated root access to Unitree G1 locomotion computers through network-facing and BLE attack paths.
- 2The BLE chain reportedly combines unauthorized characteristic writes, cloud key recovery, Wi-Fi reconfiguration, and a btgatt-server buffer overflow.
- 3Comparable robotics vulnerabilities show why engineers need end-to-end review of radio, cloud, provisioning, and privileged-service trust boundaries.
Scoring Rationale
The reported flaws provide root-level compromise paths for a humanoid robot's locomotion computer, making them materially relevant to robotics and embedded-security practitioners. The impact is constrained by the affected product line and, for the BLE route, physical radio proximity, but the chain spans cloud, wireless, and privileged local components.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
