Vulnerability · Published Feb 26, 2026 · Assigned by VulnCheck

CVE-2026-27509Unitree Go2 Missing DDS Authentication Enables Adjacent RCE

High 8.0

In plain English

A high-severity missing authentication in Unitree Go2 from UnitreeRobotics. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.6%top 48.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

Affected products (as reported)

Vendor	Product	Versions
UnitreeRobotics	Unitree Go2	1.1.7 – through 1.1.91.1.11

Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://boschko.ca/unitree-go2-rce/ technical-description, exploit
https://shop.unitree.com/products/unitree-go2 product
https://www.vulncheck.com/advisories/unitree-go2-missing-dds-authentication-enables-adjacent-rce third-party-advisory