All vulnerabilities
CVE-2026-115996

Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

Unitree Robotics Unitree Go2
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Reports 2

2 outlets mention it. Reports are not confirmation; each links to its source.

Description

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."

Text from CVE List

Affected versions 18

  • Unitree Go2affected: 1.1.0CVE List
  • Unitree Go2affected: 1.1.1CVE List
  • Unitree Go2affected: 1.1.2CVE List
  • Unitree Go2affected: 1.1.3CVE List
  • Unitree Go2affected: 1.1.4CVE List
  • Unitree Go2affected: 1.1.5CVE List
  • Unitree Go2affected: 1.1.6CVE List
  • Unitree Go2affected: 1.1.7CVE List
  • Unitree Go2affected: 1.1.8CVE List
  • Unitree Go2affected: 1.1.9CVE List
  • Unitree Go2affected: 1.1.10CVE List
  • Unitree Go2affected: 1.1.11CVE List
  • Unitree Go2affected: 1.1.12CVE List
  • Unitree Go2affected: 1.1.13CVE List
  • Unitree Go2affected: 1.1.14.0CVE List
  • Unitree Go2affected: 1.1.14.1CVE List
  • Unitree Go2affected: 1.1.15.0CVE List
  • Unitree Go2affected: 1.1.15.1CVE List

References 4