Live › vulnerability › CVE-2026-115996
Go to dashboardThe WebSocket client in the Unitree Go2 chat_go component does not properly validate the server's TLS certificate. A remote attacker positioned on the network path could impersonate the server and intercept or alter traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 23:51 UTC. All times on this page are UTC.
Owners and operators of Unitree Go2 robots running firmware in the affected range, where the chat_go WebSocket client connects to a remote server. Devices that do not use the chat_go component, or that are not on an untrusted network path, are less exposed. Teams that do not run Go2 robots can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
This page as .md · .json · in your agent: get_signal("CVE-2026-115996")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.