UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in Unitree G1 EDU Humanoid Robot (CVE-2026-76639, CVE-2026-76640)

UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in (TL-2026-2196), also tracked as UniBLEed, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-08-28 and last reviewed 2026-08-29. It has no confirmed attribution, affects Unitree Robotics G1 EDU Humanoid Robot (Locomotion PC), references 2 CVEs (CVE-2026-76639, CVE-2026-76640), maps to 18 MITRE ATT&CK techniques (T1046, T1059, T1059.004), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-2196

Threat ID
TL-2026-2196
Also known as
UniBLEed
Severity
CRITICAL
CVSS
8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-28
Last reviewed
2026-08-29
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
robotics, research and academia, manufacturing, technology
Target regions
Global
Detection rules
9
Indicators of compromise
19
Updates
2026-08-29 · revalidated 1× · latest source

Malware and tooling in UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

Malware and tooling: UniBLEed, UniTEABag

Researcher Olivier Laflamme ("Boschko") disclosed two chained root-RCE vulnerability chains in the Unitree G1 EDU humanoid robot's Locomotion PC. CVE-2026-76640 lets a nearby attacker use an unpaired BLE GATT write to recover the robot's AES-128 key via a cloud authorization bypass, hijack its Wi-Fi provisioning, and trigger a buffer overflow in btgatt-server to execute commands as root without pairing or credentials. CVE-2026-76639 reaches the same root outcome over the network via an unauthenticated WebRTC-to-DDS bridge and a path-traversal in the chat_go AI service's knowledge-upload path into bashrunner.

How UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in works

UniBLEed is a five-stage exploit chain against the Unitree G1 EDU humanoid robot's Rockchip RK3588 Locomotion PC (Linux 5.10.176-rt86+), published by researcher Olivier Laflamme (handle Boschko) on 2026-08-27 with a companion PoC toolkit and technical writeup. Two CVEs were assigned to the underlying flaws.

CVE-2026-76640 (BLE path, CVSS v3.1 7.5 HIGH / CVSS v4.0 7.7 HIGH) begins with an unpaired write to BLE GATT characteristic 0xFFE2 (service 0xFFE0, notify channel 0xFFE1) using opcode 0xF2, which triggers the robot to return an RSA-OAEP-SHA256-wrapped AES-128 bootstrap key without any authentication or pairing. The attacker then submits this wrapped blob and the robot's serial number to Unitree's cloud endpoint POST /device/bindExtData on global-robot-api.unitree.com using any free, unrelated Unitree account; the endpoint decrypts and returns the plaintext AES-128 key because it never verifies that the requesting account owns the target robot's serial number. With the recovered key, the attacker completes the BLE handshake and sends Wi-Fi provisioning data: a 121-byte PSK/credential value forces /unitree/module/network_manager/wpa_connect.sh into a fallback path where unescaped data inside an unquoted heredoc is injected directly into the generated wpa_supplicant configuration, causing the robot to join an attacker-controlled hotspot. Finally, the attacker sends a 1,050-byte SSID payload against the 500-byte wifi_ssid buffer in btgatt-server's BLE Wi-Fi SSID handler, an out-of-bounds write (CWE-787) that corrupts a function-pointer/cleanup structure in the process's .bss segment; when the corrupted event loop tears down, it invokes system() with an attacker-supplied command as root, and the backgrounded shell survives the ensuing btgatt-server crash.

CVE-2026-76639 (network-adjacent path, CVSS v3.1 8.8 HIGH / CVSS v4.0 8.7 HIGH) reaches root by a different route: an unauthenticated WebRTC-to-DDS bridge listening on TCP/9991 exposes the robot's internal DDS bus (domain 0, no authentication/encryption, RTPS discovery on multicast 239.255.0.1:7400) to any network-adjacent client. The bridge, combined with a statically stored, world-readable AES-128 key, allows an attacker to invoke the chat_go AI/knowledge-upload DDS service (CONFIG_API_ID_UPLOAD_KNOWLEDGE, id 1006) with a path-traversal filename (CWE-22) to write an attacker-controlled file into a directory whitelisted for bashrunner. Restarting/triggering bashrunner then executes the planted file as root. Both chains were reproduced across four physical G1 EDU units on firmware through V1.5.2.

Separately, the researcher's Android companion-app analysis found the G1's AES key leaking in plaintext to the app's WebView via the RTC_Start call and via BLE-timestamp diagnostic logging before the handshake completes, and bypassed the app's Baidu Jiagu packing via Frida/frida-dexdump runtime DEX extraction, recovering a hardcoded APK signing secret. Firmware images are shipped as TEA-ECB-encrypted .upk archives; the key schedule uses a plaintext 4-byte seed at offset 0x1C combined with hardcoded constants 0x6e35ba0c and 0x9a8b7c6e across 16 TEA rounds (delta 0x9E3779B9), which the researcher broke to extract and reverse firmware.

Unitree added an account-to-robot ownership check on the /device/bindExtData cloud endpoint in July 2026, ahead of public disclosure, closing the cloud-oracle key-recovery path; no confirmed patched Locomotion PC firmware version had been publicly identified as of disclosure, and the researcher noted status reflects the tested builds, not necessarily Unitree's current shipping state. The researcher characterized the BLE chain as wormable: a compromised G1 could be used to relay the same exploit to other vulnerable G1 units within Bluetooth range. Total bug bounty paid was $6,700 ($5,000 reported by one outlet for the combined submission, $4,000 + $1,000 per the researcher's own breakdown). Neither CVE is listed in the CISA KEV catalog and there is no evidence of in-the-wild exploitation; both are public PoC / coordinated disclosure.

MITRE ATT&CK techniques used in TL-2026-2196

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078.004 Valid Accounts; T1091 Replication Through Removable Media; T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services; T1570 Lateral Tool Transfer

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials; T1552.004 Unsecured Credentials: Private Keys

Impact

T1529 System Shutdown/Reboot

Reconnaissance

T1595.002 Active Scanning

Affected products and versions in UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

  • Unitree Robotics — G1 EDU Humanoid Robot (Locomotion PC)
    Vulnerable versions: through V1.5.2
    Fixed in: not publicly confirmed as of 2026-08-27
  • Unitree Robotics — Unitree companion Android application
    Vulnerable versions: tested build, version unspecified
    Fixed in: unconfirmed

Remediation for UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

Patches

  • Unitree added an account-to-robot ownership check on the /device/bindExtData cloud endpoint (July 2026, pre-disclosure)
  • No confirmed patched Locomotion PC firmware version publicly verified as of 2026-08-27 disclosure

Immediate actions

  • Restrict physical and Bluetooth (BLE) proximity access to deployed Unitree G1/G1 EDU units
  • Isolate robot management and provisioning networks from untrusted or general-purpose enterprise networks
  • Block/firewall inbound TCP/9991 (WebRTC-to-DDS bridge) from untrusted network segments
  • Review and restrict Unitree cloud account access controls tied to robot ownership/binding
  • Treat any G1 unit that has been in untrusted BLE or network range as potentially compromised pending firmware/log review

Workarounds

  • Disable or physically shield BLE radios on G1 units when not actively provisioning
  • Avoid using shared/free Unitree cloud accounts for robot binding operations
  • Monitor for unexpected Wi-Fi network associations or wpa_supplicant configuration changes on Locomotion PCs

Longer-term hardening

  • Apply Unitree firmware updates once a confirmed-patched Locomotion PC build is published and verified
  • Require BLE pairing/authentication on all GATT write characteristics (eliminate unauthenticated 0xFFE2-style writes)
  • Enforce account-to-device ownership verification on all cloud key-decryption/oracle endpoints
  • Authenticate and encrypt the internal DDS bus (domain 0) rather than relying on network position
  • Add bounds checking to BLE Wi-Fi SSID/credential handlers in btgatt-server and fuzz the BLE GATT server
  • Sandbox/whitelist-harden the bashrunner execution path against path traversal from AI/knowledge-upload services

CVEs associated with UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

CVE-2026-76639, CVE-2026-76640

Weaknesses (CWE) in UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

CWE-306, CWE-787, CWE-22

Timeline of UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

  • Researcher Olivier Laflamme (Boschko) receives a Unitree G1 EDU unit and begins security testing.
  • Researcher Boschko breaks the Unitree G1 firmware .upk TEA-ECB encryption scheme, enabling firmware extraction and reverse engineering.
  • First root RCE (chat_go path-traversal into bashrunner, later CVE-2026-76639) achieved against the G1 EDU Locomotion PC.
  • Unitree verifies the first reported root RCE chain (CVE-2026-76639) during coordinated disclosure.
  • Cloud key-recovery oracle identified: /device/bindExtData on global-robot-api.unitree.com decrypts a robot's AES key for any authenticated Unitree account without verifying ownership.
  • Second root RCE (unpaired BLE GATT write chained through cloud AES-key oracle and btgatt-server buffer overflow, later CVE-2026-76640) discovered.
  • Unitree verifies the second reported root RCE chain (CVE-2026-76640).
  • Unitree adds an account-to-robot ownership check on the /device/bindExtData cloud endpoint, closing the cloud key-recovery oracle ahead of public disclosure.
  • Unitree pays a combined $6,700 bug bounty for the two reported chains.
  • CVE-2026-76639 and CVE-2026-76640 formally assigned.
  • CVE-2026-76640 published in the NVD (CVSS 3.1: 7.5) covering the BLE GATT buffer-overflow RCE.
  • CVE-2026-76639 published in the NVD (CVSS 3.1: 8.8) covering the chat_go/bashrunner path-traversal RCE.
  • Boschko (Olivier Laflamme) publicly discloses UniBLEed with a technical writeup at boschko.ca and a PoC toolkit on GitHub (OlivierLaflamme/UniBLEed).
  • Cyber Security News, The Hacker News, GBHackers, SC Media, and other outlets publish coverage of the disclosure.

Update history for TL-2026-2196

Sources cited for UniBLEed: Unauthenticated Root RCE Chain Over Bluetooth in

More in vulnerability

Detection coverage for TL-2026-2196

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2196 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats