The first flaw, tracked as CVE-2026-76639, involves a network-adjacent exploitation path that chains through the chat_go service and bashrunner component. This route allows an attacker on the same network to escalate privileges to root on the robot's Locomotion PC without authentication.

The second vulnerability, CVE-2026-76640, is notably more severe in terms of attack scope. It enables a remote attacker to trigger the same root-level compromise over Bluetooth Low Energy (BLE), meaning an adversary within wireless range of the robot can achieve full system control without any prior network access.

• Affected product: Unitree G1 EDU humanoid robot
• Impact: Root-level remote code execution
• Attack vectors: Network-adjacent (via chat_go/bashrunner) and BLE proximity

Both chains ultimately lead to complete control of the Locomotion PC, which handles critical locomotion and navigation functions. Laflamme's disclosure highlights the growing attack surface in consumer-grade robotics, where embedded systems often prioritize functionality over security hardening.

Source: The Hacker News

Are you or your team deploying Unitree robots, and if so, how are you isolating the BLE and network interfaces from untrusted environments?