Which versions of Python are affected by CVE-2026-27509?

Unitree Go2 robots running affected firmware versions contain a critical authentication bypass in their control interface, allowing unauthorized remote manipulation of robotic actuators without…

Is there a public PoC exploit available for CVE-2026-27509?

Yes, a public proof-of-concept exploit is available for CVE-2026-27509. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27509?

Within 24 hours: Inventory all Unitree Go2 robots and identify those running V1.1.7-V1.1.9 or V1.1.11 (EDU); isolate affected units from production networks and document their locations. Within 7 days: Restrict network access to affected robots using firewall rules to block DDS traffic on port 7400 (or relevant CycloneDDS ports) from untrusted networks; implement network segmentation to limit robot communication to trusted administrative subnets only. Within 30 days: Monitor vendor advisory channels for firmware patches; establish a testing environment to validate patches before deployment; develop a phased rollout plan for firmware updates across all affected units.

Python CVE-2026-27509

Q: What is the CVSS score of CVE-2026-27509?

CVE-2026-27509 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-02-26 disclosure@vulncheck.com

Authentication Bypass Python Go2 Edu Firmware Go2 Firmware Unitree

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

May 26, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

May 26, 2026 - 14:22 NVD

8.0 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 12, 2026 - 20:17 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 20:31 nvd

HIGH 8.0

DescriptionCVE.org

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

AnalysisAI

Unitree Go2 robots running firmware versions V1.1.7-V1.1.9 and V1.1.11 (EDU) lack authentication controls on the DDS actuator API, allowing network-adjacent attackers to inject and execute arbitrary Python code as root by publishing a crafted message. Public exploit code exists for this vulnerability, which enables persistent code execution through controller keybindings that survive reboots. No patch is currently available.

Technical ContextAI

Classified as CWE-306 (Missing Authentication for Critical Function). Affects Go2 Firmware. Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pre