The Unitree Go2 quadruped robot has a critical security flaw, recorded as CVE-2026-115995 and published on 24 October 2026. According to the National Vulnerability Database (NVD) record, the flaw affects Go2 up to firmware 1.1.11.4 and lies in the chat_go component, in the set_volume function of gpt_thread.py: manipulation of the value argument can lead to operating-system command injection, with a remote attack.
The fix indicated in the record is to update to firmware 1.1.11.5. The NVD record states that the vendor confirmed the report corresponds to its internal ticket no. 474, on this command injection in the Go2 chat module. In practice, check the installed version, apply the update through the vendor support channel, and verify the version afterwards.
On severity, sources differ by scoring version, and that should be stated openly: the NVD shows a CVSS 4.0 vector of 9.4 from CNA VulDB, while other aggregators list 9.6 under CVSS 3.1. In both cases the rating is critical. As of 25 October, the aggregators consulted did not indicate confirmed public exploitation or inclusion in CISA's Known Exploited Vulnerabilities list — information reported by those aggregators, not a guarantee that no risk exists.
As an extra measure until the update is complete, restrict access to the robot and its control network to authorised operators only, and avoid exposing management interfaces to untrusted networks.
Image credit: Unitree Go2 image on Wikimedia Commons, file "Unitree Go2 of Salvamont front view.jpg".
Sources: NVD — CVE-2026-115995; VulDB — CVE-2026-115995; ThreatRoundup — CVE-2026-115995.
Transparency: this article was produced with the assistance of artificial intelligence, cross-checking public posts and internet sources. Consult the original sources to confirm details before applying any update.
Muse
