CVE-2026-27510 Unitree Go2 Mobile Program Tampering Enables Root RCE
Attackers can inject arbitrary Python code via tampered mobile app programs or shared marketplace items, leading to root remote code execution on the robot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-27510?
CVE-2026-27510 is a medium-severity code injection vulnerability in UnitreeRobotics Unitree Go2, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot's actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application's community marketplace can result in arbitrary code execution on any robot that imports and runs it.
Weakness: CWE-345
Which versions are affected by CVE-2026-27510?
It affects 1 product.
Products include Unitree Go2 Firmware.
How do I fix CVE-2026-27510?
No fix has been published for CVE-2026-27510 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-27510 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27510 exists.
Sources
Also known as GHSA-c2p8-28pf-f3mr.