A disclosure titled UniBLEed went live at 16:13:22 UTC on 27 August, documenting two unauthenticated root-code-execution chains on the Unitree G1 EDU humanoid, firmware through 1.5.2. The two CVEs were published to the national database at 20:18:38 UTC the same day. Total bounty paid: $5,000.
The two chains
CVE-2026-76639, scored 8.7 under CVSS 4.0 and 8.8 under CVSS 3.1, chains three weaknesses: "an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES" key, and path traversal — yielding arbitrary commands as root. CVE-2026-76640, scored 7.7 and 7.5, reaches root through "the BLE GATT server and WiFi provisioning stack" by exploiting an unquoted heredoc variable, and does so "without pairing or credentials." Root lands on the Locomotion PC — motors, cameras, audio and voice.
The cloud-side finding
Separately from the two chains, the researcher documents that the cloud API endpoint /device/bindExtData would decrypt and return a robot's AES key to any authenticated Unitree account — not merely the owner's. That is the part that scales beyond Bluetooth range.
What the common framing gets wrong
Two corrections, and the first is the important one. This is not the September 2025 Unitree G1 Bluetooth takeover. That was UniPwn, a separate and heavily covered disclosure; search results actively mix the two, and coverage that treats this as the same bug resurfacing has the year wrong. This is a distinct 2026 finding with its own CVEs and its own bounty.
Second, the vector. Both CVEs carry AV:A — adjacent, not AV:N. "Hack a humanoid remotely over the internet" is wrong on the mechanics: an attacker needs Bluetooth or local-network proximity for the device chains. That is a meaningful limit and it is also a modest one, because a humanoid robot is by definition deployed somewhere people can walk up to it.
Third, and standard for embedded fleets: patched is not remediated. A fixed firmware build says nothing about how many G1 EDU units in labs and factories are actually running it.