Unitree Go2 vulnerability CVE-2026-115995: a critical flaw in the robot dog's AI chat module, which firmware is affected, and the 1.1.11.5 fix

The Unitree Go2 vulnerability CVE-2026-115995 was published on October 24, 2026. It's a command injection flaw in the voice-assistant service of Unitree's four-legged robot dog, the part that talks to an AI language model, and it's rated critical. The CVE record says Go2 firmware 1.1.11.0 through 1.1.11.4 is affected and that version 1.1.11.5 fixes it. It follows the September 2025 UniPwn Bluetooth exploit, covered in our Unitree G1 story.

This story is based on the CVE record as published through the CVE Program's services, VulDB's entry and the researcher's VulDB submission, Unitree's Go2 product page and launch release, a Unitree distributor's Go2 manual, and the earlier UniPwn CVE record, checked October 25, 2026; the CVE record, NVD and Unitree's page were re-checked October 26. The CVE record references no Unitree advisory. The aggregator that first flagged the flaw isn't used as a source.

The short version

• What: an OS command injection in the set_volume function of gpt_thread.py, part of the Go2's chat_go voice-assistant component.
• Affected: Go2 firmware 1.1.11.0 to 1.1.11.4, per the CVE record.
• Fixed in: 1.1.11.5, per the CVE record, which links to a Unitree firmware package for the Go2 Edu, Max, Pro and X.
• Severity: CVSS v4.0 9.4 and v3.1 9.6, critical, scored by VulDB. The researcher proposed lower scores.
• Exploited? VulDB listed no public exploit when checked October 25. As of October 26, neither the CVE record nor NVD flags known exploitation, and no attacks have been reported. NVD hasn't yet analyzed the flaw; its entry carries VulDB's scores.

What is CVE-2026-115995?

The record's description says the flaw is in "the function set_volume of the file gpt_thread.py of the component chat_go," and that manipulating its value argument "leads to os command injection." It classifies the bug as CWE-78, OS command injection, and CWE-77, and says "The attack can be launched remotely."

The researcher's submission to VulDB explains more. It says the chat service builds a shell command from the volume value it receives and runs it as root without checking it. Because that value comes from the AI model's reply, the researcher says an attacker who can influence the upstream model response could run arbitrary commands on the robot. In the researcher's demonstration, that influence came through a separate certificate-validation weakness, which the researcher asked VulDB to track as its own entry.

That makes it a cousin of prompt injection: the danger isn't the model itself, but software that trusts what the model sends back.

Last verified: October 26, 2026

Which Go2 robots are affected?

The record lists only the 1.1.11.0 to 1.1.11.4 firmware line as affected. There's a discrepancy worth knowing: the researcher's submission named Go2 versions 1.1.4, 1.1.7 and 1.1.7.2. The record neither lists nor excludes those older versions, so whether they're affected is unclear from the published record.

The voice assistant isn't on every model. Unitree's Go2 page marks "Voice Function" for the PRO, X and EDU models and not for the AIR. Unitree launched the Go2 in July 2023 at a starting price of $1,600 and said it was "born with the empowerment of GPT." A Go2 manual published by MYBOTSHOP, a German Unitree distributor, says the chat feature, called BenBen Dog in the app, requires an internet connection through Wi-Fi.

What has Unitree said?

The CVE record references no Unitree advisory, and Unitree's Go2 page carries no security notice or 1.1.11.5 release notes. VulDB quotes a vendor statement: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."

The researcher's account of the timeline is less flattering. According to the submission, filed September 18, 2026, Unitree replied on July 21, 2026 that another researcher had already reported the issue, but had provided no CVE, public advisory or fixed version, and a September 8 follow-up got no substantive reply. VulDB accepted the submission and published the CVE on October 24.

What can Go2 owners do?

The record's guidance is to update: "Upgrading to version 1.1.11.5 is sufficient to resolve this issue." Owners can check:

• Firmware version: the distributor's manual says older firmware may restrict proper app use and points to an "update" option in the app's settings.
• Automatic updates: Unitree's product page says that "with user authorisation, the robot automatically connects to a cloud-based OTA service to upgrade its own programs," so robots that haven't authorized updates may be on older firmware.
• The chat feature: neither the CVE record nor Unitree describes a workaround short of updating. The vulnerable code is in the voice-assistant service, which the manual says needs internet access.

Organizations running Go2 robots in labs or classrooms can ask Unitree or their distributor to confirm the fixed version for their model, given the version discrepancy above.

How does this compare with UniPwn?

UniPwn, disclosed in September 2025, was a different bug. Its record, CVE-2025-35027, describes command injection through the Bluetooth module during Wi-Fi setup on Go2, G1, H1 and B2 robots, affecting Go2 firmware through 1.1.8, rated CVSS 3.1 7.3 and credited to Andreas Makris, Kevin Finisterre and Konstantin Severov. UniPwn needed an attacker within Bluetooth range; the new flaw sits in a cloud-connected AI feature.

The chat_go name has come up before. In August 2026, The Hacker News reported two Unitree G1 EDU flaws, one of them a path traversal in a G1 component also called chat_go, CVE-2026-76639. The Hacker News didn't say whether the Go2 was affected by that one. Like the PHP flaws in our PHP2Shell story, the new Go2 CVE shows how long the path can be from a private report to a public fix.

What's confirmed, reported and uncertain

• Confirmed (CVE record and VulDB): the CVE, component, affected and fixed versions, scores, credit, publication date and VulDB's quoted vendor statement.
• Reported (researcher's submission): the root-cause description, the need to influence the AI model's response, the separate certificate weakness, and the July 21 and September 8 exchanges with Unitree.
• Uncertain: whether firmware older than 1.1.11.0 is affected; when 1.1.11.5 reached owners; what else 1.1.11.5 changes; the status of the certificate-validation weakness.