CVE-2026-115995: Unitree Go2 Command Injection
TL;DR - CVE-2026-115995 is a CVSS 9.6 Critical remote OS-command-injection flaw in Unitree Go2 firmware through version 1.1.11.4. - Upgrade to firmware 1.1.11.5 or later and restrict unnecessary robot network exposure. - CISA KEV does not list the CVE, and no verified public PoC or active exploitation is currently confirmed.
CVE-2026-115995 is a critical Unitree Go2 vulnerability involving OS command injection in the chat_go component. The issue affects firmware version 1.1.11.4 and earlier and can allow commands to reach an operating-system execution path through the set_volume function. Administrators should upgrade affected robots, verify the correct firmware for each model, and monitor robot and controller networks for anomalous activity.
Are You Affected?
CVE-2026-115995 affects the Unitree Robotics Unitree Go2 platform. The vulnerable functionality is in the chat_go component, specifically the set_volume function in gpt_thread.py. The published description states that manipulating the Value argument can lead to operating-system command injection.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-115995 |
| CVSS base score | 9.6 Critical |
| CVSS vector | Not included in the available NVD response; confirm the complete NVD record before relying on individual score components |
| Attack vector | Remote |
| Authentication required | Not stated in the available record |
| User interaction | Not stated in the available record |
| Affected product | Unitree Robotics Unitree Go2 |
| Affected versions | Version 1.1.11.4 and earlier |
| Vulnerable component | chat_go, gpt_thread.py, set_volume |
| Patch available | Yes |
| Fixed version | 1.1.11.5 |
The NVD record does not provide a complete hardware-model matrix. The referenced firmware package name includes Go2_Edu_Max_Pro_X, suggesting that the package is intended for those variants, but the binary package was not independently inspected for a readable advisory or release-note matrix. Administrators should confirm the applicable image for their exact Go2 model with Unitree before deployment.
If your Go2 system reports firmware version 1.1.11.4 or an earlier release, treat it as affected. If the device reports 1.1.11.5 or a later version, the published remediation indicates that this specific issue should be resolved. Administrators should still verify the installed package, update provenance, and vendor release documentation.
For broader vulnerability prioritization, review our guide to patch management best practices.
The Fix, If You’re in a Hurry
Upgrade affected Unitree Go2 systems to firmware 1.1.11.5 or later. The NVD record explicitly identifies version 1.1.11.5 as sufficient to resolve CVE-2026-115995.
Do not interpret the absence of the CVE from CISA KEV as a reason to defer remediation. KEV status is an exploitation-intelligence signal, not a safety determination.
The firmware package referenced by the NVD record is:
package_1.1.11.5_GO2_Edu_Max_Pro_X_1761128358872.upk
The referenced package is a binary .upk file rather than a human-readable patch bulletin. Obtain the image through Unitree’s supported update process and confirm compatibility with the robot model and deployment environment.
Technical Notes
The package URL cited in the research is:
https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.11.5_GO2_Edu_Max_Pro_X_1761128358872.upk
Firmware installation procedures vary by Unitree deployment, and the available record does not provide a supported command-line updater. Do not apply a generic flashing command. Use the vendor-supported update workflow, then verify the installed version through the robot’s approved management interface or local administrative tooling.
As an immediate compensating control, isolate robot control services from untrusted networks. Permit only required controller, management, and update traffic. A generic host firewall example for a Linux-based management segment is:
# Example only: replace the subnet with the trusted robot-control network.
sudo nft add rule inet filter input ip saddr 192.0.2.0/24 accept
sudo nft add rule inet filter input counter drop
This example is not a Unitree-specific remediation and should be validated against the robot’s networking architecture before deployment. Avoid exposing robot services directly to the public internet.
Analyst’s Take: Patch inventory should come before exploit hunting. The public record does not confirm a PoC or active exploitation, but systems running
1.1.11.4or earlier remain in the affected range, and network isolation provides a practical interim control while administrators validate the correct firmware image.
How This Vulnerability Works
The vulnerability is classified as CWE-78, Improper Neutralization of Special Elements used in an OS Command. The affected set_volume function accepts a Value argument that can reach an operating-system command execution path without adequate neutralization or validation.
A volume-control value that should represent a constrained setting may instead be interpreted as part of a shell or operating-system command. If an attacker can reach the vulnerable remote functionality and control that value, the attacker may cause the process to execute commands with the privileges available to the affected service.
The available NVD data does not disclose the exact command construction statement, input transport, authentication boundary, or patch diff. It is therefore not possible to responsibly state whether the root cause is shell concatenation, unsafe invocation of a command interpreter, insufficient numeric validation, or another implementation detail. Defenders should avoid building exploit-specific detections from an assumed payload format.
Technical Notes
The known technical identifiers are:
Component: chat_go
File: gpt_thread.py
Function: set_volume
Argument: Value
Weakness: CWE-78
Impact: OS command injection
A secure implementation would constrain the value to an appropriate numeric range and invoke a dedicated API without shell interpretation. That design conclusion is general defensive guidance, not a claim about the vendor’s exact patch. The published record does not confirm whether version 1.1.11.5 uses strict validation, an argument-array API, escaping, or another remediation method.
Severity, Explained
The vulnerability carries a CVSS base score of 9.6, rated Critical. The available research record identifies the issue as remotely exploitable and describes command execution as the result of manipulating the Value argument. Remote OS-command injection is high impact because successful execution can provide control at the privilege level of the affected process and may enable follow-on access to connected systems or robot-control infrastructure.
The exact CVSS vector was not present in the supplied NVD response. Accordingly, the individual CVSS components, such as network scope, privileges required, user interaction, confidentiality, integrity, and availability impacts, should not be reconstructed from the score alone. Confirm the complete NVD JSON record before using component-level scoring in risk calculations or automated prioritization.
The operational risk remains significant even without the full vector. Robot deployments often operate on networks that include controllers, telemetry systems, update services, cameras, or other operational technology. A compromised robot service could be used for unauthorized command execution, disruption, reconnaissance, or lateral movement, depending on network segmentation and process privileges.
Organizations reviewing internet-facing robot-management exposure may also benefit from comparing secure web gateways and SWG controls.
Is It Being Exploited?
Active exploitation is not confirmed. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog based on the available lookup:
on_kev: false
cve_id: CVE-2026-115995
There is no CISA KEV date-added date, remediation due date, required action, or ransomware-campaign flag for this CVE. This means CISA has not included it in the catalog; it does not prove that no exploitation has occurred.
A public proof of concept is also not confirmed. The reviewed sources did not identify a verified repository specifically demonstrating exploitation of CVE-2026-115995. A GitHub repository containing Unitree firmware tools was found, but it was not clearly documented as a CVE-specific exploit. Research involving other Unitree Go2 vulnerabilities should not be treated as evidence of a PoC for this CVE.
The current assessment is:
| Evidence category | Status |
|---|---|
| Remote exploitability | Stated in the NVD description |
| Public PoC for CVE-2026-115995 | Not confirmed |
| In-the-wild exploitation | Not confirmed |
| CISA KEV listing | No |
| Ransomware exploitation confirmation | Not applicable from KEV data |
Detecting It in Your Environment
Begin with asset and firmware inventory. Identify every Unitree Go2 system, its hardware variant, installed firmware version, network location, management interface, and controller dependencies. Any system at version 1.1.11.4 or earlier should be prioritized for upgrade or isolation.
Network monitoring is especially important because the available record does not disclose the precise vulnerable request path or protocol. Monitor robot and controller segments for unexpected inbound connections, unusual access to chat or volume-control services, outbound connections from robot systems that are not required for operations, and traffic from untrusted networks. Detection should focus on behavioral anomalies rather than a presumed exploit string.
Technical Notes
A basic Zeek query can help identify unexpected HTTP activity involving a volume-related endpoint or parameter, if the service uses HTTP and the traffic is visible to the sensor:
event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string)
{
if ( /(?i)(set_volume|volume)/ in unescaped_URI ||
/(?i)(set_volume|volume)/ in c$http?$referrer )
{
print fmt("Review possible Go2 volume request: %s %s from %s to %s",
method, unescaped_URI, c$id$orig_h, c$id$resp_h);
}
}
This is a triage rule, not a confirmed exploit signature. It may generate false positives and will not detect encrypted traffic, alternate protocols, or requests whose volume function is not represented in the URI.
For centralized logs, search for process or shell execution associated with the robot service. The exact process name is not established by the available record, so use the service inventory to replace the example process names:
# Generic SIEM search pattern; adapt field names and process names.
(process.name:(sh OR bash OR dash OR cmd OR powershell)
OR process.command_line:(/bin/sh OR /bin/bash OR " -c "))
AND host.asset_type:"Unitree-Go2"
Also investigate:
- Unexpected child processes spawned by
chat_goor its parent service. - Shell metacharacters or command-like content in volume-related request logs.
- New outbound connections immediately after volume-control requests.
- Firmware version changes that lack an approved change record.
- Repeated failed requests followed by process crashes or service restarts.
Preserve relevant network captures, application logs, process telemetry, and firmware metadata before rebooting a suspected device. Since the public record does not provide a known exploit payload, avoid treating the absence of a specific string as evidence that exploitation did not occur.
Recommended Response Plan
- Inventory Go2 systems. Record model, firmware version, network location, and controller dependencies.
- Prioritize affected versions. Treat firmware
1.1.11.4and earlier as vulnerable. - Upgrade safely. Install Unitree firmware
1.1.11.5or later using the vendor-supported process. - Restrict exposure. Remove unnecessary internet access and limit management traffic to trusted networks.
- Review telemetry. Check process, network, authentication, and firmware-change logs for anomalies.
- Preserve evidence. Capture relevant logs and network data before restarting a potentially compromised system.
- Reassess after remediation. Confirm the installed version and validate that segmentation and monitoring controls remain effective.
References and Further Reading
The primary reference is the NVD record for CVE-2026-115995:
The firmware package identified by the NVD record is available at:
Additional vulnerability references include:
- VulDB: CVE-2026-115995
- VulDB submission 990502
- VulDB vulnerability entry 426093
- VulDB CTI entry 426093
- Unitree developer documentation
CVE-2026-115995 was published on October 24, 2026, and this assessment reflects the NVD and CISA KEV information available during research. The practical priority is to identify Go2 systems running through version 1.1.11.4, upgrade to 1.1.11.5 or later, reduce unnecessary network exposure, and monitor for unexpected process and network activity.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.