Improper Certificate Validation in Unitree Robotics Go2 WebSocket Client
CVE-2026-115996

6.3MEDIUM

Key Information:

Vendor

Unitree Robotics

Status
Unitree Go2
Vendor
CVE Published:
24 October 2026

What is CVE-2026-115996?

A vulnerability exists within the WebSocketClient.connect function in the websocket.py file of Unitree Robotics' Go2 products, which includes versions up to 1.1.15.1. This issue pertains to improper validation of server certificates during WebSocket communications, allowing remote attackers to exploit this weakness. The difficulty in exploiting this vulnerability has been recognized, and while it requires specific conditions, it poses significant risks if left unaddressed. The vendor has confirmed that this issue was brought to their attention and is tracked under their internal security processes.

Affected Version(s)

Unitree Go2 1.1.0

Unitree Go2 1.1.1

Unitree Go2 1.1.2

References

https://vuldb.com/vuln/426094
vdb-entrytechnical-description
https://vuldb.com/vuln/426094/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-115996
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JasperXJY (VulDB User)
VulDB CNA Team
.