CVE-2026-27509: Unitree Go2 Missing DDS Authentication Enables Adjacent RCE

Vulnerability summary

CVE-2026-27509 is a high (CVSS 8.5) vulnerability in unitree go2_firmware. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-02-2026
   PublishedVulnerability first disclosed.
2. 26-05-2026
   Last modifiedVulnerability information updated.

Description

Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.