CVE-2026-115996 Details
Description
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
A vulnerability exists in Unitree Robotics Unitree Go2 versions prior to 1.1.13, 1.1.14.1, and 1.1.15.1. The issue arises in the WebSocketClient.connect function within the websocket.py file of the chat_go component, where improper validation of TLS server certificates is performed. This flaw allows for remote attacks, although the exploitation is considered difficult due to the high complexity involved.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/cve/CVE-2026-115996 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/990504 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426094 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426094/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Unitree Robotics Unitree Go2 | <= 1.1.13 (semver) <= 1.1.14.1 <= 1.1.15.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |