Unitree Go2: CVE-2026-115995, a command injection rated 9.6/10 in the robot's chat module

Unitree Go2: CVE-2026-115995, a 9.6/10 command injection in the robot's chat module

🔎 A connected quadruped, a microphone, and a 9.6/10 flaw

Since its launch at $1,600 (July 2023), the Unitree Go2 has established itself as the most widespread quadruped on the consumer market. Schools, laboratories, SMEs, individuals: thousands of these machines patrol classrooms and living rooms. And like any "AI-ready" product, they chat with language models.

On October 26, 2026, that carefree attitude took a hit. The disclosure of CVE-2026-115995 describes an OS command injection rated 9.6/10 on the CVSS scale — the Critical band — in the robot's chat module. An attacker able to reach the robot can execute system commands remotely, without authentication.

The flaw itself is almost mundane: an unsanitized string passed to a system command. What is far less mundane is what it reveals about the state of the robotics industry. Deploying a patch across thousands of physical machines — dormant, dispersed, owned by private individuals — is nothing like a web deployment. That's the real story here.

The essentials

• The flaw: CVE-2026-115995, OS command injection (CWE-78), CVSS 9.6/10 (Critical), in the chat_go component of the Unitree Go2.
• The entry point: the set volume function in the gpt thread.py file executes system commands remotely via the Value argument, without validation.
• Affected versions: up to and including firmware 1.1.11.4. Fix: firmware 1.1.11.5, tracked under vendor ticket #474.
• Threat status: no public PoC, no known exploitation to date (October 26, 2026, source killtheai).
• The real challenge: getting this patch down to a fleet of physical robots — a far harder exercise than for a web server.

Recommended tools

No need for an arsenal: four tools are enough to inventory, patch, isolate, and monitor Go2s.

CVE-2026-115995 : the vulnerability in plain terms

Direct answer: CVE-2026-115995 is an OS command injection (CWE-78) rated 9.6/10, present in the chat_go component of the Unitree Go2 up to and including firmware 1.1.11.4. A fix exists: firmware 1.1.11.5.

The chat_go component is the piece that connects the robot to a remote LLM — GPT-5.5, Gemini 3.1 Pro, or a self-hosted model like Kimi K2.6 depending on the configuration. It is what handles the conversational settings, including audio volume. In other words: the vulnerability sits at the heart of the very feature that sold the robot.

Anatomy: set volume, gpt thread.py and the Value argument

In gpt thread.py, a background thread processes the parameters returned by the conversational module. The set volume function adjusts the speaker volume by building a system command — and concatenating the Value argument into it without any filtering.

The result: anyone who manages to submit a crafted value to this interface gains arbitrary command execution with the robot's privileges. That is the exact definition of CWE-78, OS command injection, as documented by MITRE.

The consequences go far beyond the gadget. Microphone, cameras, movement commands, foothold inside your local network: a compromised robot is a compromised computer — with legs.

Why 9.6 — and what it doesn't mean

The CVSS v3.1 scale (FIRST, 2019) classifies as Critical any score between 9.0 and 10.0. The 9.6 of CVE-2026-115995 comes from near-maximal dimensions: network vector, low exploitation complexity, no privileges required, no user interaction, high impact on confidentiality and integrity.

An important clarification: CVSS measures technical severity, not the likelihood of attack. A 9.6 with no public PoC is still a 9.6 — active threat is measured elsewhere.

What we don't know yet

As of the disclosure date (October 26, 2026), no public PoC has circulated and no exploitation has been observed, according to killtheai. That's good news, and it should be said.

But be wary. Technical details circulate, robots stay in service for years, and the history of IoT vulnerabilities shows that the window between disclosure and public exploitation is often counted in weeks. This grace period should be used to patch — not to watch.

Patching a physical robot: a whole different ballgame than the web

Direct answer: a web patch deploys in minutes with automatic rollback; a robot patch deploys in weeks, machine by machine, with a real risk of rendering the device unusable.

On the web, everything is tooled up: canary deployments, blue-green, rollback in seconds, observability. A dedicated team knows how many servers are running, on which version, and where.

A Go2, on the other hand, lives in someone's home. Updating it assumes decent Wi-Fi, a charged battery, and an owner willing to take their machine out of service during the flash. An interrupted flash can brick the device. And nobody knows exactly where the unpatched robots are.

The numbers from professional teams are already dizzying: according to Mandiant's analysis (2023), organizations take an average of about 32 days to patch an actively exploited vulnerability — on servers, with dedicated teams. For consumer robots, add the friction of "the owner has to click."

Regulation is pushing in the right direction. The EU Cyber Resilience Act (regulation 2024/2847, in force since December 2024, full obligations by end of 2027, vulnerability reporting from September 2026, source EUR-Lex) requires security updates for the entire announced support period. The UK has required since April 2024 (PSTI regulation) that manufacturers declare their support period. The era of connected devices with no update commitment is closing — far too slowly.

My opinion is firm: a manufacturer that sells a mobile robot equipped with a microphone and cameras without a firm, quantified support-period commitment isn't selling a product — they're selling a problem.

What Unitree Says — and What Should Be Demanded

Direct answer: Unitree fixed the flaw in firmware 1.1.11.5, tracked under ticket #474, with no known exploitation to report. That's the bare minimum; the job isn't done.

Credit where credit is due. The patch exists, the tracking reference is public, and no wild exploitation has been observed. Plenty of vendors do worse, and more slowly.

But a numbered ticket is no substitute for a security advisory. What should be demanded — and what no consumer robot manufacturer yet provides properly — comes down to five things: a detailed advisory (vector, versions, mitigations), a signed OTA channel with deployment statistics, a support duration commitment per model, a firmware SBOM, and a disclosure policy paired with a bug bounty.

The most critical point is deployment statistics. Without them, no one — not the vendor, not the researchers, not the customers — knows what proportion of the fleet remains vulnerable. On the web, we measure. With robots, we hope.

Context: breakneck growth, an accumulating security debt

Direct answer: Unitree is going through a phase of spectacular expansion, and every robot sold today is a device that will need patching for years.

The company's IPO made headlines: +460% on the first day of trading and a valuation of around $50 billion, as we detailed in our article on Unitree's IPO. This momentum is also visible on the international stage, with Chinese humanoid robots making an appearance at Haneda Airport (our coverage).

The problem is that commercial speed and security maturity are not progressing at the same pace. Every growth milestone adds thousands of devices in production at customers who never signed up to become robot sysadmins.

A fleet needs managing: inventory, update channels, support duration, incident response. If Unitree wants to sustain its valuation, security must move from being ticket #474 to being a first-class feature.

Robots that are ever more autonomous, an attack surface that's exploding

Direct answer: every leap in autonomy adds software, and every line of software adds attack surface. The Go2 chat module is just a symptom.

The industry is moving fast. Boston Dynamics Atlas chains together industrial tasks in full autonomy, SigLoMa learns manipulation in the real world through vision alone, and Sony Ace beats professional table tennis players — a result published in Nature.

All these systems share the same DNA: massive software stacks, learned models, telemetry and update channels. The equation is simple: autonomy equals software, and software equals attack surface.

The difference from the web is the physical matter. A compromised server displays a corrupted page; a compromised quadruped physically moves around, with a microphone and cameras, in the middle of a home or a school. The same vulnerability doesn't carry the same weight.

The Go2 chat module illustrates exactly this dynamic: LLM features sell robots, but hooking an LLM up to a mobile machine imposes network interfaces that should never have existed on a legged motor. You can't want the features without accepting the surface.

Action plan: secure your Go2s this week

Direct answer: update to firmware 1.1.11.5, move the robot off your main network, and monitor it. One hour of work eliminates most of the risk.

1. Inventory. Locate every robot on your network:

nmap -sn 192.168.1.0/24

1. Update. Upgrade to firmware 1.1.11.5 via the app or the official Unitree tool. Battery charged above 50%, power plugged in, no interruptions during the flash. For a fleet, test on one robot first, then roll out in waves.
2. Isolate. A dedicated VLAN or SSID for robots, with no access to the main network. Segmenting IoT devices is among the baseline recommendations from CISA. No port forwarding to the robot, ever.
3. Control remote access. If you need to reach a robot off-site, go through a mesh VPN like Tailscale rather than an open port on your router.
4. Monitor. An Uptime Kuma or Grafana instance on a small VPS — Hostinger works great for this — lets you keep your logs and alerts at home, instead of depending on the vendor's cloud.
5. Follow up. Keep ticket #474 handy, watch Unitree advisories and the killtheai thread for any developments.

❌ Common Mistakes

Mistake 1: confusing CVSS severity with attack probability

CVSS tells you how serious a vulnerability is if it is exploited, not when it will be. Many people will read "no public PoC" and conclude they have time.

The fix: treat severity as a patch prioritization order, not as a weather forecast. At 9.6/10, the update gets scheduled this week.

Mistake 2: believing the local network provides protection

The vulnerability can be triggered from any network capable of reaching the robot. A compromised laptop, a guest with the Wi-Fi password, another vulnerable IoT device: the pivot is trivial.

The fix: strict segmentation. A separate VLAN or SSID for robots, and zero port forwarding. The robot doesn't need to be reachable from the Internet to function.

Mistake 3: postponing the update "until the next stable version"

The fear of regression is legitimate — a firmware update can break behaviors. But waiting for the next version means leaving a 9.6/10 vulnerability open for weeks, on a machine that listens and moves around.

The fix: the canary pattern, transposed to the physical world. One test robot, a full functional validation, then a staged rollout. This is exactly what web teams have been doing for ten years.

Mistake 4: thinking that disabling the chat module is enough

Cutting off the chat module reduces the attack surface, that's true. But the vulnerable component remains present in the firmware, and you pay a permanent functional cost without any guarantee of complete coverage.

The fix: disabling is a temporary mitigation, not a patch. Firmware 1.1.11.5 is the only measure that solves the problem at its root.

❓ Frequently Asked Questions

Is my Go2 affected by CVE-2026-115995?

Yes, if your firmware is version 1.1.11.4 or earlier. Check in the Unitree app or the official upgrade tool, under the system information section. If you have already installed version 1.1.11.5 or later, the vulnerability is patched and no further action is needed.

Has the vulnerability already been exploited?

No, as of the disclosure date (October 26, 2026): no public PoC has circulated and no exploitation has been observed, according to killtheai. But the absence of a PoC is no guarantee: the technical details are enough for a motivated researcher to reconstruct the attack. Patch without delay.

What does exploitation actually allow?

Arbitrary OS command execution (CWE-78) with the robot's privileges: access to the microphone, cameras, and movement commands, plus a possible pivot to your local network. In practice, an attacker who reaches the chat module interface takes full control of the machine.

How do I apply firmware 1.1.11.5 safely?

Use the official Unitree app or tool, with a battery charged above 50% and a stable Wi-Fi connection. Never cut the power during the flash. For a fleet, update one test robot first, validate its functions, then roll out the rest in waves.

Should the robot be disconnected in the meantime?

If you can't patch immediately: yes, take it off the network. An offline robot cannot be reached via CVE-2026-115995, which exploits the network interface of the chat module. You lose the connected features, but you keep a healthy device. Reconnect it only after updating to 1.1.11.5.

✅ Conclusion

CVE-2026-115995 is not the flaw that will make headlines — it's the one that demands action: at 9.6/10 on a robot sold to individuals, firmware 1.1.11.5 should be applied this week, not next quarter. Check your version right now on Unitree's website, and apply the action plan above.