Olivier Laflamme published a writeup on Thursday with two independent ways to get root on a Unitree G1 EDU. One of them starts from nothing but being in Bluetooth range. No pairing, no credentials, no account bound to the robot. You stand near it, you write to the right characteristic, you end up with a root shell on the machine that runs the legs.

Before the "it's just a lab toy" reflex kicks in, some context on what we're talking about. The G1 line starts at $13,500 for the base unit and runs to about $43,900 for the EDU tier — the one you actually buy if you intend to program the thing rather than film it dancing. Unitree shipped more than 5,500 humanoids in 2025, roughly a third of the global market, which makes the G1 the best-selling humanoid on earth by a comfortable margin. Most of them live in university labs and research groups. Some are doing real work: baggage handling at Haneda, facility cleaning contracts.

So: thousands of roughly 35-kilo machines with cameras, microphones and actuators, mostly parked in rooms full of people. Hold that thought.

The Bluetooth one

CVE-2026-76640. The G1 exposes a BLE provisioning interface — the thing that exists so you can hand the robot your Wi-Fi credentials the first time you power it on. Every connected device on the planet has one of these. It is the most boring surface in the building, which is precisely why it's the one that gets you.

The bootstrap interaction is accepted without pairing. That's step one, and it's already most of the story: an unauthenticated stranger can start a conversation with the provisioning stack.

Step two is the bit that made me put the coffee down. To get the key material for that conversation, you ask Unitree's cloud. The cloud checked that you had a valid Unitree account. It did not check that your account had anything to do with that robot. So you could ask for, and receive, key material belonging to somebody else's G1. Not a crypto break, not a side channel — a missing WHERE owner_id = ?, essentially.

And from there, a buffer overflow in the provisioning path lands you as root on the Locomotion PC.

Worth noting that the encryption was never really the wall here anyway. Researchers found last year that the G1's BLE traffic ran AES-CFB under a key and IV baked into every unit in the fleet. When every robot ships with the same key, the encryption isn't a control, it's a costume.

The other one

CVE-2026-76639 is network-adjacent rather than radio-adjacent, and it's the one I'd frame and hang on a wall.

There's a knowledge-base upload workflow with a path traversal in it. Fine, ancient, we've all seen it. What makes it fun is where you get to write: into the whitelist directory of a component called bashrunner. And bashrunner builds its whitelist at import time and decides what to execute using shell rules that don't care about file extensions.

So you drop a file somewhere it shouldn't go, and a completely different part of the system helpfully picks it up and runs it as root. Neither half is exotic on its own. Chained, they're a shell.

That's the thing about robots: they're not one program, they're a dozen daemons sharing a filesystem and an unspoken agreement that everything on disk got there legitimately.

None of this is clever, and that's the problem

Run the list back. Path traversal. Unauthenticated provisioning. A server-side lookup that authenticates the caller but never authorises them against the resource. A memory-safety bug in a parser eating attacker-controlled input. That's not novel research, that's the starter pack — every one of those bug classes has a Wikipedia article older than the company.

And look, I don't say that to dunk on Unitree specifically. The humanoid industry is a robotics industry with an embedded-Linux problem, shipping at consumer-electronics velocity without any of the consumer-electronics scar tissue. Router vendors got beaten into shape over fifteen years of getting owned in public. Nobody has done that to the robot people yet, so they're currently making 2011's mistakes with 2026's funding.

The difference is blast radius. When your NAS gets popped you lose files. When a humanoid gets popped, whoever did it inherits a camera, a set of microphones, a network position inside a research VLAN, and — the part people skip past — a body. In a room. With people in it.

If there's one of these in your building

Per Laflamme, Unitree patched the cloud ownership check back in July 2026, so the cloud-assisted route now wants an account actually bound to the target robot, or the key material already in your pocket. Good, genuinely.

The less good part: nobody's been able to point at a specific fixed firmware release for either CVE. Which means "am I patched?" currently has no answer you can grep for, and that's an awkward place to be with a machine that has motors.

The boring mitigations are the real ones. Treat it as hostile hardware you happen to own: its own VLAN, no route to anything you'd miss, egress logged. Do provisioning somewhere "Bluetooth range" is a set you control rather than a corridor. And power it down when nobody's using it — which sounds like advice from a helpdesk script, except the entire BLE chain depends on the thing sitting there listening.

So

The part that sticks with me isn't the CVEs, it's how thoroughly familiar they are. We spent two decades learning not to trust the network on devices whose worst-case failure was leaking your holiday photos. Those same patterns are now shipping inside something that can pick objects up and walk toward you.

The gap between "embedded firmware quality" and "thing with arms" is the actual story, and two CVEs aren't going to close it.

Anyway. If there's a G1 in your lab, go find out what VLAN it's on. I'll wait.