{"id":"CVE-2026-115996","kind":"vulnerability","aliases":["CVE-2026-115996"],"related":[],"title":"Unitree Go2 robot chat client skips TLS certificate validation","description":"A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: \"These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295).\"","summary":"The WebSocket client in the Unitree Go2 chat_go component does not properly validate the server's TLS certificate. A remote attacker positioned on the network path could impersonate the server and intercept or alter traffic.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iot","robotics","unitree-go2","vendor"],"not_affected_if":["default-config"],"how_to_check":"- Check the Go2 firmware version against the affected range up to 1.1.13, 1.1.14.1 and 1.1.15.1 (unknown how to read it from the device)\n- Review chat_go websocket.py WebSocketClient.connect for certificate verification being disabled (unknown if the sources give the exact code)","fix":"- Update the Unitree Go2 firmware to a release newer than the affected versions (unknown which version is fixed; the vendor has tracked it internally as ticket #616)\n- Contact Unitree for the patched version","status":"open","published_at":"2026-10-24T23:16:58+00:00","first_seen_at":"2026-10-24T23:51:08+00:00","triaged_at":"2026-10-25T04:00:01+00:00","updated_at":"2026-10-25T04:00:01+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:00:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Unitree Go2 firmware to a release newer than the affected versions (unknown which version is fixed; the vendor has tracked it internally as ticket #616)\n- Contact Unitree for the patched version","reach":"network","title":"Unitree Go2 robot chat client skips TLS certificate validation","impact":"medium","summary":"The WebSocket client in the Unitree Go2 chat_go component does not properly validate the server's TLS certificate. A remote attacker positioned on the network path could impersonate the server and intercept or alter traffic.","category":"vendor","nicknames":[],"who_cares":["unitree-go2","robotics","iot","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker impersonates server and reads or alters robot chat traffic","analyst_note":"Confirm the fixed firmware version and whether the chat_go WebSocket connection is used in default configuration; check the vendor advisory tied to Security Response Center submission 990504.","how_to_check":"- Check the Go2 firmware version against the affected range up to 1.1.13, 1.1.14.1 and 1.1.15.1 (unknown how to read it from the device)\n- Review chat_go websocket.py WebSocketClient.connect for certificate verification being disabled (unknown if the sources give the exact code)","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Owners and operators of Unitree Go2 robots running firmware in the affected range, where the chat_go WebSocket client connects to a remote server. Devices that do not use the chat_go component, or that are not on an untrusted network path, are less exposed. Teams that do not run Go2 robots can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":3468,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115996':12A,15A '-2026':11A,14A '-295':157C '/1.1.14.1/1.1.15.1':71C '1.1.13':70C '616':145C '990504':139C 'affect':73C 'alter':57B 'attack':44B,95C,101C 'center':130C 'certif':8A,41B,92C,154C 'chat':4A,30B,84C,147C 'client':5A,25B,150C 'complex':103C 'compon':32B,83C 'confirm':116C 'correspond':140C 'could':50B 'cve':10A,13A 'cwe':156C 'detect':62C 'difficult':113C 'disabl':151C 'earli':117C 'embed':16B 'exploit':109C 'file':79C 'follow':137C 'function':75C 'go':31B,85C,148C 'go2':2A,21B,29B,67C,146C 'high':107C 'imperson':51B 'improp':91C 'initi':98C 'intercept':55B 'intern':135C,143C 'iot':17B 'issu':119C 'manipul':88C 'may':96C 'network':48B 'path':49B 'perform':86C 'platform':131C 'posit':45B 'previous':121C 'proper':35B 'rate':105C 'remot':43B,99C 'report':111C 'research':125C 'respons':129C 'result':89C 'robot':3A,18B,65C 'secur':128C 'server':38B,53B,153C 'skip':6A 'submiss':138C 'submit':122C 'ticket':144C 'tls':7A,40B,152C 'track':134C 'traffic':58B 'unitre':1A,20B,28B,64C,66C 'unitree-go2':19B 'valid':9A,36B,93C,155C 'vendor':22B,115C 'vulner':60C 'websocket':24B 'websocket.py':80C 'websocketclient.connect':76C 'wss':149C","nicknames":[],"mitigations":[],"who_affected":"Owners and operators of Unitree Go2 robots running firmware in the affected range, where the chat_go WebSocket client connects to a remote server. Devices that do not use the chat_go component, or that are not on an untrusted network path, are less exposed. Teams that do not run Go2 robots can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T23:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115996","severity":null,"published_at":"2026-10-24T23:16:58+00:00","modified_at":"2026-10-24T23:16:58+00:00","first_seen_at":"2026-10-24T23:51:08+00:00","fetched_at":"2026-10-24T23:51:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}