CVE-2026-1442

Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.

• CWE-321

• https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001111111111110101111111111000000000000000000000000000000000000000000000000000000101Exploit, Third Party Advisory
• https://github.com/Bin4ry/UniTEABagExploit, Third Party Advisory
• https://www.linkedin.com/posts/kevin-finisterre-6431069a_in-case-you-want-to-teabag-unitree-robotics-activity-7432984361014091776-zB4DThird Party Advisory
• https://x.com/bin4rydigit/status/2027197985625420242Third Party Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14414Insufficient validation of untrusted input in Skia in Google…5.3
• CVE-2026-14415Inappropriate implementation in V8 in Google Chrome prior to…8.8
• CVE-2026-14416Out of bounds read in Dawn in Google Chrome prior to 150.0.7…9.6
• CVE-2026-14417Use after free in Dawn in Google Chrome prior to 150.0.7871.…9.6
• CVE-2026-14418Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7…4.3
• CVE-2026-14419Use after free in Skia in Google Chrome prior to 150.0.7871.…9.6
• CVE-2026-14420Out of bounds read and write in Dawn in Google Chrome prior …9.6
• CVE-2026-14421Uninitialized Use in Dawn in Google Chrome on ChromeOS prior…6.5
• CVE-2026-14422Out of bounds read and write in Tint in Google Chrome prior …8.8
• CVE-2026-14423Type Confusion in Tint in Google Chrome prior to 150.0.7871.…9.6
• CVE-2026-14424Use after free in Dawn in Google Chrome on Mac prior to 150.…9.6
• CVE-2026-14425Use after free in ANGLE in Google Chrome prior to 150.0.7871…9.6