A single HTTP request can completely take over the Reachy Mini AI robot

Five vulnerabilities found in the robot

JFrog Security Research reported on November 3, 2026, on its investigation of Reachy Mini, developed by Pollen Robotics and Hugging Face. The open-source robot is built on the Raspberry Pi Compute Module 4 and is available in Lite and Wireless versions, priced at $399 and $499, respectively, according to the source.

Reachy Mini is designed for voice- and vision-based interaction and can be used for educational and research purposes. A Python-based daemon controls its servo motors, camera and audio, while also installing applications from the Hugging Face Spaces ecosystem. The daemon runs a FastAPI-based HTTP server for communication between the robot and its associated dashboard.

JFrog identified five CVEs. By chaining them together, the researchers demonstrated attacker code execution, persistent root access and, ultimately, control of the robot's motors. The company says another attack scenario could require only that an operator open a malicious website, which would compromise the device in the background.

The network-accessible daemon runs without authentication

At the center of the problem is reachy-mini-daemon, which controls the main functions of the robot. The service listens on TCP port 8000 on every network interface in all operating modes. The Wireless version exposes the daemon on the robot's Wi-Fi interface, the Lite edition on the developer's computer, and the simulator on the local machine.

Wireless robots can also be discovered through mDNS under the name reachy-mini.local. According to JFrog, the service has no authentication, while its CORS configuration allows every website to send requests. As a result, an attacker on a shared home Wi-Fi network, office LAN or conference demonstration network could access the control interface.

According to the source, the localhost-only option does not actually restrict network listening. The setting only affects whether the WLAN IP address is displayed, while the uvicorn server continues to bind to 0.0.0.0. The researchers say operators using the option may therefore remain exposed.

An installation endpoint can trigger the attack

According to JFrog's analysis, a key part of the attack chain is the application installation endpoint. In the /api/apps/install request, the client can send the daemon a path specified as a local source, which the daemon passes directly to the uv pip install command. The endpoint has no allowlist, URL validation or restriction on the source type.

When installing from a pip package source, pip can automatically run build-time code required to assemble the package, such as the setup.py file. JFrog emphasizes that this is documented pip behavior. The risk comes from the process being controlled by unauthenticated network input.

In the example presented by the researchers, the attacker places a malicious Python source package on an HTTP server accessible to the robot, then sends a single HTTP request to install it. The daemon responds with a task ID, while the package build process can execute attacker code.

Update and temporary protection

According to JFrog, the flaws affect versions released before the fixed 1.11.0 version. For those unable to update immediately, the company recommends blocking port 8000 with a firewall. On the robot, this can be applied to the WLAN interface, and on a workstation, to every interface except loopback.

Other temporary measures include avoiding the installation of untrusted applications, tightening sudo rules and refraining from browsing the internet while connected to the robot's network. JFrog specifically notes that these measures are not a substitute for installing the patched software.

According to the source, the flaw affects multiple modes of Reachy Mini use. This means the risk can extend to the device's own Wi-Fi network, developer workstations and locally run simulators if the daemon is operating on a network accessible to an attacker.