Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
- Products
- Unitree Go2
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-115996
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 15:56 UTC · Revision 2
Source evidence
Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
core-cve · Original sourcePublished 24 Oct 2026, 22:30 UTC
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
cve:CVE-2026-115996
Unitree Go2
Fixed versions: Not specified
Complete source record
{
"id": "b8da8cf041f1c3f39fff63ae61d41787bde04900f305789412ba0f250da32375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-115996",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation",
"summary": "A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: \"These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295).\"",
"evidence": "cve:CVE-2026-115996",
"products": [
{
"name": {
"value": "Unitree Go2",
"evidence": "/containers/cna/affected/0/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "CVE-2026-115996",
"aliases": [
"CVE-2026-115996"
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:C"
}
}
],
"affected": [
{
"cpes": [
"cpe:2.3:a:unitree_robotics:unitree_go2:*:*:*:*:*:*:*:*"
],
"vendor": "Unitree Robotics",
"modules": [
"chat_go"
],
"product": "Unitree Go2",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "affected",
"version": "1.1.4"
},
{
"status": "affected",
"version": "1.1.5"
},
{
"status": "affected",
"version": "1.1.6"
},
{
"status": "affected",
"version": "1.1.7"
},
{
"status": "affected",
"version": "1.1.8"
},
{
"status": "affected",
"version": "1.1.9"
},
{
"status": "affected",
"version": "1.1.10"
},
{
"status": "affected",
"version": "1.1.11"
},
{
"status": "affected",
"version": "1.1.12"
},
{
"status": "affected",
"version": "1.1.13"
},
{
"status": "affected",
"version": "1.1.14.0"
},
{
"status": "affected",
"version": "1.1.14.1"
},
{
"status": "affected",
"version": "1.1.15.0"
},
{
"status": "affected",
"version": "1.1.15.1"
}
]
}
],
"modified": "2026-10-26T17:37:33.986Z",
"provider": "cve",
"references": [
"https://vuldb.com/vuln/426094",
"https://vuldb.com/vuln/426094/cti",
"https://vuldb.com/cve/CVE-2026-115996",
"https://vuldb.com/submit/990504"
],
"provider_metadata": {
"adp": [
{
"title": "CISA ADP Vulnrichment",
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-115996",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-26T15:38:55.918601Z"
}
}
}
],
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-10-26T17:37:33.986Z"
}
}
],
"cna": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-10-24T22:30:21.197Z"
}
}
},
"related_cves": [
{
"value": "CVE-2026-115996",
"evidence": "/cveMetadata/cveId"
}
],
"security_relevant": true,
"severity_evidence": "/containers/cna/metrics"
},
"source_id": "core-cve",
"document_id": 326383,
"published_at": "2026-10-24T22:30:21.197+00:00"
}