Riskcovery

CVE-2026-115996

Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

State
Published
Severity
6.3 Medium
Published
Oct 24, 2026
Updated
Oct 26, 2026
Reserved
Oct 24, 2026

Read the record on cve.org

Description

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:XVulDB
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:CVulDB
3.03.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:CVulDB
2.02.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:CVulDB

Weaknesses

  • CWE-295 Improper Certificate Validation
  • CWE-287 Improper Authentication

Affected Products

ProductVersions
Unitree Go2Unitree Robotics
  • 1.1.0Affected
  • 1.1.1Affected
  • 1.1.2Affected
  • 1.1.3Affected
  • 1.1.4Affected
  • 1.1.5Affected
  • 1.1.6Affected
  • 1.1.7Affected
  • 1.1.8Affected
  • 1.1.9Affected
  • 1.1.10Affected
  • 1.1.11Affected
  • 1.1.12Affected
  • 1.1.13Affected
  • 1.1.14.0Affected
  • 1.1.14.1Affected
  • 1.1.15.0Affected
  • 1.1.15.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.