Researchers have uncovered a significant vulnerability in Unitree G1 humanoid robots that allows attackers within Bluetooth range to gain root-level access to the robot's locomotion computer. This critical flaw, part of a research project called UniBLEed, enables the manipulation of key hardware functions such as movement, cameras, and other peripherals. The vulnerability stems from a multi-stage exploit involving Bluetooth Low Energy, Unitree's cloud API, and the Wi-Fi provisioning system in the robot's Linux-based control environment.
The attack chain, identified with CVE-2026-76639 and CVE-2026-76640, starts with a Bluetooth service that accepts writes without requiring pairing. Attackers can send a cleartext request to a specific GATT characteristic to receive an encrypted package containing data essential for recovering the robot's AES-128 encryption key. This key is initially protected with RSA encryption, but a flaw in Unitree's cloud service allows any authenticated account to decrypt this data, even if the account does not own the robot. This oversight has been classified as an authorization failure.
Once the AES key is obtained, attackers can manipulate the robot's Wi-Fi setup through unsafe handling of Wi-Fi credentials, potentially connecting the robot to an attacker-controlled hotspot. The vulnerability further extends to the Bluetooth server, where improper handling of incoming data allows memory corruption, leading to root command execution. These issues pose a significant threat as the robots' locomotion computers run Linux services with root privileges, critical for physical operation.
To mitigate these risks, Unitree has implemented an ownership-binding check for their cloud decryption endpoint and released patches addressing most of the vulnerabilities. Robot owners are advised to apply the latest firmware and app updates, avoid exposing their robots to untrusted Bluetooth devices, and ensure management networks are isolated from sensitive systems.