CVE-2026-12990: Vision 60 Robot Auth Bypass Vulnerability

CVE-2026-12990 Overview

CVE-2026-12990 is an access control vulnerability [CWE-284] affecting the Ghost Robotics Vision 60 quadruped robot mobile application (APK v5.5.0). The application permits multiple simultaneous sessions without proper client validation or session integrity checks. An attacker using a modified version of the app can join an active session while the legitimate operator remains connected. This enables interception of real-time video, partial control of the robot, and bypass of operational restrictions without alerting the authorized user.

Critical Impact
Adjacent-network attackers can hijack live robot sessions, exfiltrate real-time video, and issue commands without disconnecting the legitimate operator, undermining operational security of a robotic platform frequently deployed in defense and critical infrastructure contexts.

Affected Products

Ghost Robotics Vision 60 robot
Vision 60 mobile control application (APK v5.5.0)
Deployments relying on the affected APK for teleoperation

Discovery Timeline

2026-07-27 - CVE-2026-12990 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-12990

Vulnerability Analysis

The Vision 60 mobile application does not enforce single-session semantics or validate the identity of connecting clients against the currently active session. The robot's control interface accepts a second concurrent session over the adjacent network without terminating, notifying, or degrading the first. Because session integrity checks are absent, the robot treats an unauthorized client as a peer of the legitimate operator.

An attacker with a tampered version of the APK can therefore attach to an in-progress teleoperation session. Once attached, the attacker receives streamed telemetry and video, and can issue a subset of control commands. The legitimate operator observes no disconnection, no session-conflict warning, and no visual indicator that a second controller is present.

The root weakness is broken access control at the session layer, aggravated by the lack of mutual authentication between the app and the robot's control endpoint. This class of flaw is common in IoT and robotics platforms where pairing is treated as a one-time event rather than a continuously validated trust relationship.

Root Cause

The underlying defect is improper access control ([CWE-284]). The Vision 60 control endpoint authorizes any client presenting valid pairing state, without binding that state to a unique session, verifying client integrity, or rejecting concurrent controllers. Session establishment is not coupled to session ownership.

Attack Vector

Exploitation requires adjacent-network access, meaning the attacker must be within radio range or on the same wireless segment used by the robot and its operator. The attacker runs a modified build of the Vision 60 APK that skips or alters client-side session-uniqueness checks and connects to the robot while a legitimate session is active. No user interaction from the legitimate operator is required. Refer to the INCIBE CERT Notice on Vulnerabilities for coordinated advisory details.

Detection Methods for CVE-2026-12990

Indicators of Compromise

Multiple concurrent client connections to the Vision 60 control endpoint from distinct source addresses during a single operational window.
Duplicate or unexpected video-stream subscribers observed in robot-side telemetry logs.
Presence of Vision 60 APK builds with signatures that do not match the vendor-issued package.
Unauthorized wireless clients associated with the operator's tactical access point or ad-hoc network.

Detection Strategies

Baseline the expected number of active sessions per robot and alert on any deviation.
Inspect wireless traffic near operational deployments for unauthorized associations to the robot's SSID or peer-to-peer link.
Perform integrity checks (hash comparison, signing-certificate validation) on installed Vision 60 APKs across managed mobile devices.

Monitoring Recommendations

Forward robot control-plane logs and mobile device telemetry to a centralized analytics platform for correlation.
Monitor for anomalous command sequences or control inputs that conflict with the legitimate operator's actions within short time windows.
Track APK version and signature drift on any device authorized to operate Vision 60 platforms.

How to Mitigate CVE-2026-12990

Immediate Actions Required

Restrict Vision 60 operation to isolated wireless segments with strong link-layer authentication and encryption.
Physically and logically limit adjacent-network exposure during missions, including reducing radio range where feasible.
Audit all mobile devices used to control Vision 60 units and remove unauthorized or unsigned APK builds.
Contact Ghost Robotics for the current fixed release and coordinated remediation guidance.

Patch Information

At time of publication, no fixed version has been listed in the NVD entry for CVE-2026-12990. Refer to the INCIBE CERT Notice on Vulnerabilities and coordinate directly with Ghost Robotics for authoritative patch availability.

Workarounds

Operate Vision 60 only over dedicated, encrypted wireless links with pre-shared keys rotated per mission.
Enforce mobile device management policies that block sideloaded or modified Vision 60 APKs.
Maintain visual oversight of the robot during operation to detect anomalous behavior indicative of a second controller.
Disable or shield the robot's wireless interface when not in active use to reduce the window for adjacent-network attack.

bash

# Example: verify installed Vision 60 APK signature against a known-good hash
adb shell pm path com.ghostrobotics.vision60
sha256sum /path/to/pulled/vision60.apk
# Compare output to the vendor-published SHA-256 for the authorized release