The Patching Friars' AlmanacA calendar of CVE saints

Patron of August 27

UniBLEedHoly card for unibleed, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 UniBLEed ROBOTUS RADIX
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint UniBLEed, Who Gave the Robot Its Root

Patron of humanoid robots, AES keys decrypted for anyone, and Bluetooth left open.

Life

On 27 August 2026 Olivier Laflamme published UniBLEed: root on the Unitree G1 humanoid robot from Bluetooth range. The chain combined a BLE characteristic writable without pairing, which handed out the robot's encrypted AES-128 key, and a cloud endpoint that decrypted it for any account, up to a buffer overflow that ran code as root. According to the author the chain was even wormable, able to hop from one robot to another.

Prayer

O Saint UniBLEed, who gives the robot orders without asking its leave, let our keys stay out of the firmware and our Bluetooth always demand pairing. Amen.

How to celebrate

Celebrated by updating the G1 firmware and turning Bluetooth off when the robot should not be paired.

A robot listening on BLE, its master within reach.

Technical record

Disclosed on
August 27 2026
CVE
CVE-2026-76639CVE-2026-76640
CVSS
8.8
Product
Unitree Robotics · G1 EDU

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess.

Sources: boschko.ca

Canonized during the vacant see

Related saints

Sharing the feast day

The “bleed” family

Same year: 2026

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.