Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

A security researcher, Olivier Laflamme, disclosed two separate attack chains affecting the Unitree G1 EDU robot. Both chains can ultimately reach root remote code execution on the robot’s Locomotion PC. That matters because root access gives unusually broad control over a computer’s software and data.

The disclosed vulnerabilities have the identifiers CVE-2026-76639 and CVE-2026-76640. The source describes one route as network-adjacent and says it passes through chat_go and bashrunner. It describes the other as a Bluetooth Low Energy, or BLE, path. The excerpt does not provide every technical step in either chain.

The disclosure shows that the robot’s attack surface is not limited to one connection type. Network-facing components and nearby wireless interfaces can both matter. The article establishes the existence of two independent chains, but it does not state their patch status, exploitation in the wild, or the exact final impact on robot movement.

Remote code execution means an attacker can make a target computer run attacker-chosen instructions without being physically present. “Root” identifies the highest-level account on many Unix-like systems. Together, the term describes remote execution with broad administrative authority.

For example, a flaw might let an attacker send specially crafted input to a reachable service. If the resulting command runs as root, it can potentially read protected files, change system settings, install software, or control other processes. Ordinary application restrictions may no longer stop those actions.

This is why the Unitree disclosure is serious: the reported chains can reach root on the robot’s Locomotion PC. The source does not describe every command an attacker could run or every safety consequence. In general, however, root RCE is more severe than code execution confined to a single, low-privilege program.

The disclosure involves two independent chains affecting the Unitree G1 EDU. “Independent” means each chain represents a separate route to the reported root outcome. An attacker therefore may have more than one avenue to target the same important computer.

The first chain is described as network-adjacent and passes through chat_go and bashrunner. The second uses Bluetooth Low Energy, or BLE, as its starting point. The source excerpt does not specify the exact network conditions, BLE messages, or vulnerable code involved at each first step.

This difference broadens the robot’s exposure. A network-adjacent route depends on access through a relevant network path or nearby network environment. A BLE route uses the robot’s wireless Bluetooth interface instead. Both chains reportedly can reach root on the Locomotion PC, but the article excerpt does not say whether either route has been exploited publicly.

Bluetooth Low Energy is a short-range wireless technology used by nearby devices to communicate with one another. In the disclosed case, BLE provides the starting point for an attack chain against the Unitree G1 EDU. This matters because a robot may be exposed even when an attacker is not using its ordinary network connection.

The article identifies a BLE path that can reach root on the robot’s Locomotion PC. However, the supplied excerpt does not explain the precise BLE service, pairing state, message, or software flaw that begins the chain. It only establishes BLE as the entry route and root access as the reported outcome.

That limitation is important when interpreting the claim. The disclosure shows that Bluetooth must be treated as part of the robot’s security boundary. It does not, from the provided text, prove that every nearby device can connect automatically or describe the range and practical conditions required for exploitation.

Gaining root on the Locomotion PC would give an attacker the operating system’s highest privileges. That could allow extensive control over programs, files, configurations, and running processes. Because this computer is associated with locomotion, unauthorized changes could be especially sensitive.

In general, root access may let an attacker inspect protected data, alter software, disable services, install persistence, or issue commands through local programs. It could also support attempts to interfere with robot functions. These are potential consequences of root access, not specific actions confirmed by the supplied article.

The source establishes that both disclosed chains can reach root on the Locomotion PC. It does not state whether an attacker can directly command motors, alter safety controls, steal particular data, or cause physical harm. Those outcomes would depend on the robot’s architecture, permissions, and safety systems, which the excerpt does not describe.

The network-adjacent attack path is described as running through two named components: chat_go and bashrunner. In an exploit chain, a path through components means weaknesses or unsafe interactions across those stages help carry an attacker from an initial reachable interface toward greater privileges.

The supplied article fragment does not define chat_go or bashrunner in detail. It does not say whether chat_go receives messages, whether bashrunner executes scripts, or which component contains each vulnerability. Therefore, the safest supported description is that both are involved in the network-adjacent chain identified with the disclosure.

Their inclusion matters because security risk can arise from how components connect, not only from one isolated program. A reachable service may pass attacker-controlled data to another component, allowing the chain to progress. The article confirms that this route can reach root on the Locomotion PC, but the excerpt omits its exact commands and triggering inputs.

Operating systems separate ordinary programs from root to enforce least privilege. Most applications need only limited access to their own files, processes, and services. They should not automatically change system settings, read every user’s data, or control protected hardware.

This boundary limits damage when software contains a bug. If an attacker takes over a low-privilege program, the attacker normally inherits that program’s restricted permissions. Access controls can block changes to protected files and prevent interference with unrelated services. Additional defenses, such as sandboxing, can narrow access further.

A privilege-escalation flaw defeats that containment. In the Unitree case, the disclosed chains reportedly reach root on the Locomotion PC, making the result more serious than a confined application compromise. The source does not describe the robot’s exact permission model, but the general security principle explains why root access is a major escalation.