Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-76639

CVE-2026-76639HIGH

Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    8.7   .0067   50.4     —

AFFECTED
  Product  Versions     Fixed
  G1 EDU   unspecified  —

TIMELINE
  Aug 19  Reserved by VulnCheck
  Aug 27  Published (CNA: VulnCheck)
  Aug 31  EXPLOIT PUBLISHED — CVE-2026-76639 (Unitree Robotics G1 EDU). Public exploit reference added.

CWE-22, CWE-306 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred

Description

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 19, 2026	Reserved	Reserved by VulnCheck
August 27, 2026	Published	Published (CNA: VulnCheck)
August 31, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-76639 (Unitree Robotics G1 EDU). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Unitree Robotics	G1 EDU	—	—	—

Weaknesses

CWE-22 · CWE-306

References (3)

Authoritative record: CVE-2026-76639 at cve.org

Vendors: unitree robotics

Weaknesses: CWE-22 · CWE-306

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-76639 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.