◆ CVE Hub

CVE-2026-115996

Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

Published
2026-10-24
Last modified
2026-10-24
CNA
VulDB
NVD status
Received
CWE
CWE-287 CWE-295
CVSS v3.1 (listed by NVD)
3.7
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0 (listed by NVD)
6.3
MEDIUM
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
6.3
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interactionConditions Confidentiality NIntegrity LAvailability N

This vulnerability may be exploitable over the internet without authentication or user interaction.

MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACHHigh (conditions required)
Privileges required PRNNone
User interaction UINNone
Scope SUUnchanged
Confidentiality CNNone
Integrity ILLow
Availability ANNone
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

NVD

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)4.06.3 MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD / [email protected] (Primary)3.13.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD / [email protected] (Secondary)2.02.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
CNA / VulDB4.06.3 MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
CNA / VulDB3.13.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C
CNA / VulDB3.03.7 LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C
CNA / VulDB2.02.6 AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:C

Affected products and packages

CNA (CVE.org)

VendorProductVersions
Unitree RoboticsUnitree Go2
affected: 1.1.0
affected: 1.1.1
affected: 1.1.2
affected: 1.1.3
affected: 1.1.4
affected: 1.1.5
affected: 1.1.6
affected: 1.1.7
affected: 1.1.8
affected: 1.1.9
affected: 1.1.10
affected: 1.1.11
affected: 1.1.12
affected: 1.1.13
affected: 1.1.14.0
affected: 1.1.14.1
affected: 1.1.15.0
affected: 1.1.15.1

Linux distribution status

Red Hat ↗

Not tracked by this distribution.

Debian ↗

No record

Ubuntu ↗

Not tracked by this distribution.

References (4)