CVE-2026-27509: Unitree Go2 Missing DDS Authentication Enables Adjacent RCE
Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (apiid=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27509?
CVE-2026-27509 is a critical vulnerability due to its potential for remote code execution in affected firmware versions.
How do I fix CVE-2026-27509?
To fix CVE-2026-27509, update the Unitree Go2 firmware to version 1.1.10 or later to enable DDS authentication.
What versions of Unitree Go2 firmware are affected by CVE-2026-27509?
Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) are affected by CVE-2026-27509.
What type of attack can CVE-2026-27509 enable?
CVE-2026-27509 can enable adjacent remote code execution attacks due to the absence of DDS authentication.
Who is impacted by CVE-2026-27509?
Users of the affected Unitree Go2 firmware who have not updated to the fixed version are at risk from CVE-2026-27509.