CTI · reviewed · 2026-09-16

Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1552 Unsecured Credentials Credential Access
• T1210 Exploitation of Remote Services Lateral Movement

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• cybersecurefox.com domain · active · corroborated

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Marimo Notebook CVE-2026-39987 Unauthenticated WebSocket RCE
id: 7b6a5c4d-3e2f-1098-bad0-fedcba987654
status: experimental
description: >
    Detects exploitation of CVE-2026-39987, a pre-authentication RCE
    in marimo Python notebook framework. Attackers connect to the
    /terminal/ws WebSocket endpoint which ships without authentication
    in versions through 0.20.4, obtaining an interactive PTY shell.
    This enables rapid credential theft and lateral movement, with
    documented cases of AWS credential extraction in 8 seconds.
references:
  - https://cyberpress.org
  - https://gbhackers.com
author: Tia N. List
date: 2026-09-16
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: network_connection
  product: linux
detection:
  selection_websocket_endpoint:
    dst_path|contains: '/terminal/ws'
  condition: selection_websocket_endpoint
falsepositives:
  - Legitimate marimo notebook WebSocket connections from authenticated users
level: high

References

• https://cyberpress.org
• https://gbhackers.com