Reachy Mini robot: five chained flaws give LAN attacker root and control of motors, camera and mic
Severity: high · Patch status: partial · Since 2026-11-03 · CVE-2026-53605, CVE-2026-55419, CVE-2026-62661, CVE-2026-96455, CVE-2026-96456
JFrog Security Research describes five vulnerabilities in the Reachy Mini robot from Pollen Robotics and Hugging Face, chained into takeover. The HTTP route starts with an unauthenticated app-install endpoint in the reachymini daemon (CVE-2026-96455, NVD CVSS 8.8, adjacent network) that runs attacker code through a pip install. A passwordless sudo grant in the Wireless OS image then gives persistent root (CVE-2026-53605, fixed in OS 0.2.4). From there an attacker can drive the motors, camera and microphone. A browser variant relied on permissive CORS and an operator's stored Hugging Face token; later releases restricted CORS and added DNS-rebinding and cross-site request defences. A Bluetooth route chains an unauthenticated file upload (CVE-2026-55419, fixed in 1.8.2), a Bluetooth PIN race (CVE-2026-96456, fixed in 1.12.0) and a Bluetooth path traversal (CVE-2026-62661, no fixed version listed in its advisory when checked). Exposure is the robot's Wi-Fi or LAN reach to daemon port 8000, or Bluetooth radio proximity; no source claims internet exposure. JFrog published a proof-of-concept video. No source reports exploitation in the wild.
What to do
- Update reachy_mini to 1.12.0 or later (latest release checked: 1.13.0, 2026-10-26) and the Wireless OS image to 0.2.4 or later; JFrog's v1.11.0 advice does not cover the Bluetooth PIN race fixed in 1.12.0
- Until updated, block TCP 8000 on the robot's Wi-Fi interface (JFrog's workaround) and keep the robot off shared or untrusted networks
- Do not install untrusted apps or Hugging Face Spaces on the robot; the install endpoint is the main attack primitive
- Check the Wireless image's sudoers file and narrow any blanket NOPASSWD grant to the commands the daemon needs
- Watch GHSA-vg3x-4hxm-3gxm (CVE-2026-62661) for a fixed version; treat Bluetooth command access as open until one is published
- Stop using the robot's camera and microphone in sensitive areas until updated and audited
Fixed versions
- reachy-mini-os 0.2.4 (CVE-2026-53605)
- reachy_mini 1.8.2 (CVE-2026-55419)
- reachy_mini 1.11.0 (CVE-2026-96455, per NVD reference)
- reachy_mini 1.12.0 (CVE-2026-96456)
Sources
All live incidents on Threat Watch
