CVE-2026-27509 describes a missing authentication vulnerability (CWE-306) in UnitreeRobotics Unitree Go2 firmware versions 1.1.7 through 1.1.9 and 1.1.11 (EDU). The vulnerability affects the DDS topic rt/api/programming_actuator/request handled by actuator_manager.py, which does not enforce DDS authentication or authorization. An attacker on the same network can join DDS domain 0 and send a crafted message (api_id=1002) containing arbitrary Python code. This code is saved under /unitree/etc/programming/ and bound to a physical controller keybinding, which executes the code with root privileges when triggered. The binding remains effective after reboot, allowing persistent root-level code execution.

An unauthenticated, network-adjacent attacker can achieve persistent root code execution on affected Unitree Go2 robots by exploiting this vulnerability. This compromises the integrity and control of the device, potentially allowing full system takeover. The vulnerability does not require prior authentication or privileges, increasing its severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the DDS domain 0 to trusted entities only and monitor for unauthorized DDS domain joins. Avoid exposing the robot's network interfaces to untrusted networks. Follow UnitreeRobotics advisories for updates on patches or official mitigations.