CVE-2026-115996: Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-24 · updated 2026-10-26
Weakness: CWE-287

Description

A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."

Affected products

Unitree Robotics Unitree Go2: 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5 (+12)

References

Get alerted when CVE-2026-115996 or the next vulnerability affects your stack