CVE-2026-115996: Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chatgo. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chatgo WSS client disabled TLS server certificate validation, CWE-295)."
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Unitree Go2 devices running versions up to 1.1.13, 1.1.14.1, or 1.1.15.1 are identified as affected. The issue is in the chat_go component's WebSocketClient.connect implementation in websocket.py.
What must an attacker do to exploit this issue?
The attack can be initiated remotely and involves manipulating the WebSocket connection's certificate validation. Exploitation is rated high complexity and reported as difficult; no attacker privileges or user interaction are specified.
What is the likely security impact?
The reported impact is limited to integrity, with no reported confidentiality or availability impact. The issue is classified as improper certificate validation, and the vendor states that TLS server certificate validation is disabled in the affected WSS client.