UnitreeRobotics Unitree Go2 up to 1.1.9 Message actuator_manager.py missing authentication

Summaryinfo

A vulnerability classified as critical has been found in UnitreeRobotics Unitree Go2 up to 1.1.9. Affected is an unknown function of the file actuator_manager.py of the component Message Handler. Performing a manipulation results in missing authentication. This vulnerability is cataloged as CVE-2026-27509. The attack must originate from the local network. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in UnitreeRobotics Unitree Go2 up to 1.1.9. This affects some unknown processing of the file actuator_manager.py of the component Message Handler. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

The weakness was shared by Olivier Laflamme and Ruikai Peng. It is possible to read the advisory at boschko.ca. This vulnerability is uniquely identified as CVE-2026-27509 since 02/19/2026. The exploitability is told to be easy. Access to the local network is required for this attack to succeed. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• UnitreeRobotics

Name

• Unitree Go2

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion