Log in Start free

Vulnerability · Published Oct 24, 2026 · Assigned by VulDB

CVE-2026-115996Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

Low 3.7

In plain English

A low-severity improper certificate validation in Unitree Go2 from Unitree Robotics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."

Affected products (as reported)

VendorProductVersions
Unitree Robotics Unitree Go2 1.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.7

Weakness: CWE-295, CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C

References