Unitree Go2 flaw lets a forged AI reply run root commands on the robot dog

What was disclosed

Two vulnerabilities in the voice assistant of Unitree's Go2 quadruped robot became public on 24 October 2026. The more serious one, CVE-2026-115995, is an operating-system command injection in a component called chat_go. The CVE record, written by the vulnerability database VulDB acting as the assigning authority, scores it 9.6 out of 10 on CVSS 3.1 and 9.4 on CVSS 4.0, both rated critical. It says the flaw sits in the set_volume function of a file named gpt_thread.py and that the attack can be launched remotely.

The second record, CVE-2026-115996, covers the same component. It says chat_go's WebSocket client does not properly check the TLS certificate of the server it talks to. VulDB scores that one far lower, 3.7 on CVSS 3.1 and 6.3 on CVSS 4.0, because on its own it requires an attacker to sit in the network path. Together the two flaws form a chain: the weak certificate check lets an attacker impersonate the robot's AI server, and the injection turns a fake AI reply into commands that run with full control of the robot's computer.

Both reports were filed with VulDB on 18 September by a user named JasperXJY. The submission for the injection credits Junye Xiong of Sichuan University and describes an authorised test on a Go2 the researcher owns. The scores in the CVE records are VulDB's. In the submission, the researcher suggested lower ones, 7.7 for the full chain as demonstrated and 8.9 if the attacker already controls the AI replies, because both assume an attacker on the robot's local network.

How the attack works

The Go2's voice assistant does not run its language model on the robot. According to the submission, chat_go holds a WebSocket connection to a Unitree cloud service at gpt-proxy.unitree.com and receives structured function calls back from the model, the same mechanism chatbots use to trigger tools. One of those functions changes the speaker volume. When the model asks for set_volume, chat_go builds the shell command amixer set Speaker followed by the value it received, and runs it through a shell.

There is no check on that value. The submission says there is no type parsing, range check, allow-list or escaping, and that the chat_go service runs as root, the all-powerful administrator account on the robot's Linux system. So a volume value of 50 changes the volume, but a value of 50 followed by a semicolon and another command makes the robot run that second command as well, with root rights.

To reach that code, an attacker has to control what the robot believes the model said. In the researcher's demonstration that came from the certificate flaw. With control of DNS on the network, the test redirected the hard-coded server name to a machine the researcher ran, presented a self-signed certificate that chat_go accepted, and answered a single voice command or app message with a forged function call. The submission says the test took about five minutes. A harmless marker payload created a file owned by root, and the device log recorded 21 executions that day, 19 of them returning success.

The researcher has not released exploit code. The submission says the logs, proof-of-concept material and a video of the full chain are being kept private pending coordinated disclosure, and VulDB lists no public exploit. That is the difference from the prompt-injection cases this site has covered recently, such as agent frameworks that obey a repeat-after-me prompt or a booby-trapped AGENTS.md file that hijacks coding agents. Here nobody has to trick the model at all; an attacker only has to pose as it.

Which firmware is affected

The version information is where the two records stop agreeing. The researcher's submission names firmware 1.1.4, 1.1.7 and 1.1.7.2, says the vulnerable code is byte-for-byte identical in those packages and in a newer one for the Max and Pro models, and states that the fixed version is unknown. The published CVE-2026-115995 record names none of those versions. It lists firmware 1.1.11.0 through 1.1.11.4 as affected and says that upgrading to 1.1.11.5 is enough to resolve the issue.

The certificate record goes the other way. It lists firmware from 1.1.0 through 1.1.13 and then 1.1.14.0, 1.1.14.1, 1.1.15.0 and 1.1.15.1 as affected, marks no version as fixed, and VulDB's entry says no mitigation is known. Severity Daily, which compared the records, points out that the firmware the critical record tells owners to install is several version lines older than the newest firmware the companion record calls affected. Neither record says whether the 9.6 flaw still exists in the 1.1.12 to 1.1.15 builds. Severity Daily also notes that NVD, the US government's vulnerability database, had not analysed either record, so VulDB's scores are the only ones that exist.

What Unitree has said

Unitree's only public words are short confirmations quoted in the CVE records. For the injection, the company said the VulDB submission "corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)." For the certificate flaw, it said the issues "were previously submitted by the researcher through our Security Response Center platform" and are tracked as ticket #616.

The researcher's timeline describes slow progress through that channel. The injection was reported to Unitree's Security Response Center on 18 July. Three days later Unitree replied that another researcher had already reported it. In early September the researcher added on-device proof to the ticket and asked about a CVE and fixed versions, then sent a follow-up email with six questions on 8 September. The submission says there was no substantive reply by 18 September, although Unitree's tracker showed both tickets had passed an internal fix-confirmation stage. Severity Daily says Unitree's security page is a submission form that publishes no advisories or version-to-fix mapping. AI Lookout found no Unitree advisory for either CVE.

Why an AI voice feature made this worse

The injection itself is an old class of bug. Severity Daily lists two earlier Go2 records from September 2025, CVE-2025-60017 and CVE-2025-35027, that also gave root command execution, through WiFi name and password fields passed to a restart script. What is new is the route in. The voice assistant treats output from a cloud language model as trusted instructions, then hands part of that output straight to a shell on a machine that walks around.

That pattern is spreading as companies bolt large language models onto physical products, and it changes what a compromise means. Root access on a robot dog is not just access to a speaker. The Go2 carries cameras, lidar and motors and is used by researchers, rescue teams and hobbyists, often on ordinary office or home networks. Robotics groups also use it as a test platform, including for agentic navigation research. Any function a model can call is effectively an input from outside, and needs the same validation as text typed into a web form.

What Go2 owners can do

Severity Daily's practical advice is to read the firmware version off the robot rather than guess it. If it is 1.1.11.0 to 1.1.11.4, the CVE record's own text says 1.1.11.5 fixes the injection. For any other version, no record says whether the 9.6 applies, and installing 1.1.11.5 could move a newer robot backwards. Because no record lists a fix for the certificate flaw, the safer assumption is that the voice assistant's link to its server can still be impersonated.

That makes network placement the main defence. The demonstrated chain needs an attacker who can control name lookups on the robot's network, so keeping Go2 units off shared or guest WiFi and on a segment the owner controls removes the easiest path. Owners who do not use the voice assistant can avoid relying on it until Unitree states which builds contain the fixes. Severity Daily also cautions that the 1.1.11.5 package is linked from a third-party database rather than a vendor advisory, and that a separate 2026 record says Unitree's firmware encryption keys are exposed, so an update file should be checked against something Unitree supplies directly.

What is still unknown

The most important missing fact is simple: which Go2 firmware builds contain the fixes for tickets #474 and #616. Unitree knows, because it tracks the tickets, but it has not published that mapping. It is also unclear whether the earlier reporter Unitree mentioned found the same chain, whether the same chat_go code ships on Unitree's other robots, and whether the cloud server can now refuse forged sessions on its side.

None of this means Go2 robots are being attacked; there is no public exploit and no report of misuse. It does show a gap between how quickly AI features reach consumer hardware and how slowly the security details reach the people who own it. Until Unitree publishes an advisory, owners have only two databases that disagree and a researcher's account of a five-minute test.