Reported by 7 outlets
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The vulnerability is CVE-2026-39987, a pre-authentication remote code execution flaw in the reactive Python notebook platform marimo. Affected versions are 0.20.4 and earlier; version 0.23.0 patches it by adding the missing authentication validation to the /terminal/ws WebSocket endpoint. The endpoint skips validate_auth() entirely, granting any unauthenticated remote client an interactive PTY shell. During the nine-hour intrusion observed by Sysdig Threat Research Team, the attacker opened a WebSocket session at 18:57:22 UTC, recovered AWS credentials from the notebook environment and its Redis-backed application data by 18:57:26, wrote an SSH private key retrieved from AWS Secrets Manager to /tmp/bastion_key, and authenticated to an internet-facing bastion host at 18:57:30. That eight-second pivot from initial access to bastion entry shows the attack is fully scripted. The operator relied on hand-built automation rather than LLM-generated tooling, dropped base64-encoded Python scripts into /tmp/, and iteratively refined boto3 and SSH routines over the intrusion.
A successful compromise means full cloud pivot, not just notebook access. The attacker does not stop at the marimo process; they harvest AWS keys, call Secrets Manager, retrieve SSH keys, and establish persistent access to bastion hosts. Any organization running marimo instances with cloud integrations, environment files, or database connections is exposed regardless of whether the instance is public-facing by design, because the WebSocket endpoint requires zero credentials. This story matters more than generic notebook RCE reports because the timeline is compressed to seconds rather than hours, the target is a niche data-science tool that security teams often miss in asset inventories, and the attacker behavior shows deliberate cloud-pivot planning rather than opportunistic scanning. The GitHub advisory GHSA-2679-6mx9-h9xc was published April 8, 2026, and exploitation began 9 hours and 41 minutes later, with no public proof-of-concept available at the time of first observed activity.
Upgrade immediately to marimo 0.23.0 or restrict the /terminal/ws endpoint at the network layer. If the endpoint cannot be disabled, block inbound WebSocket traffic to it at the reverse proxy or firewall. Rotate all AWS credentials, SSH private keys, and application secrets stored in .env files or environment variables on any instance that was reachable before patching. For hunting, inspect logs for WebSocket connections to /terminal/ws without preceding authentication events, look for file writes to /tmp/bastion_key, scan /tmp/ for base64-encoded Python payloads, and review process trees for boto3 or SSH child processes spawned from the marimo server process. The Sysdig Threat Research Team observed exploitation from source IP 49.207.56.74 during their honeypot campaign.
Watch whether CISA adds CVE-2026-39987 to the Known Exploited Vulnerabilities catalog, since the NVD entry already lists EPSS at 99.564 percent and the advisory was published without a CVE number initially assigned. Also monitor for publication of a public exploit script; the GitHub advisory included a proof-of-concept demonstrating a single WebSocket connection yielding a root-level interactive shell, so weaponization by additional actors is probable. If exploitation expands beyond the single source IP observed by Sysdig, expect broader scanning of internet-facing marimo endpoints.
Timeline
-
original reporting
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
cyberpress.org · 28d ago · September 15th, 2026
A threat actor exploited a pre-authentication remote code execution flaw in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in eight seconds. Tracked as CVE-2026-39987, the vulnerability affects marimo versions through 0.20.4. The flaw stems from missing authentication on /terminal/ws , exposing an interactive PTY shell to remote clients able to connect. Marimo version 0.23.0 fixes the issue by adding the missing authentication validation. Sysdig observed the operator use the access to run an end-to-end cloud pivot chain during a nine-hour intrusion. Marimo RCE Flaw The attacker opened a WebSocket session, recovered AWS credentials from the compromised notebook environment and its Redis-backed application data , called Secrets Manager, wrote a private key to /tmp/bastion_key , and used it to access an internet-facing bastion. At 18:57:22 UTC, a WebSocket session began. Four seconds later, the attacker recovered an AWS key from the application’s stored credentials. At 18:57:30, SSH authentication to the bastion was recorded. The compressed sequence shows how quickly a prepared toolkit can turn notebook compromise into deeper cloud access. Unlike previously tracked operators exploiting the same bug, this actor appeared to rely on hand-built automation rather than LLM-generated tooling. Over several hours, they dropped base64-encoded Python scripts into /tmp/ and iteratively refined boto3 and SSH routine
-
update from github.com
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass (GHSA-2679-6mx9-h9xc)
github.com · 189d ago · April 8th, 2026
The GitHub advisory published on April 8, 2026, documents CVE-2026-39987, a critical pre-auth remote code execution vulnerability in marimo versions through 0.20.4. The terminal WebSocket endpoint /terminal/ws skips the validate_auth() check that other endpoints enforce, allowing any unauthenticated client to open a full interactive PTY shell. The fix was released in marimo 0.23.0 via PR #9098. The advisory includes a proof-of-concept script and notes that commands run as root in default Docker deployments.
-
update from sysdig.com
Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours
sysdig.com · 188d ago · April 9th, 2026
The attacker connected to the /terminal/ws endpoint without authentication, validated execution with a scripted PoC, then manually explored the filesystem, read .env files, and attempted to retrieve SSH private keys. No public proof-of-concept existed at the time of the first observed exploitation attempts. The blog details the attacker timeline from 07:31 to 09:04 UTC on April 9 and confirms the complete credential-theft chain occurred in under three minutes.
-
update from nvd.nist.gov
CVE-2026-39987 Detail - NVD
nvd.nist.gov · 188d ago · April 9th, 2026
The National Vulnerability Database entry published April 9, 2026, assigns CVSS v4.0 score 9.3 (Critical) to CVE-2026-39987. It confirms the vulnerability affects marimo versions prior to 0.23.0, describes the missing authentication on the /terminal/ws WebSocket endpoint, and lists the weakness as CWE-306 (Missing Authentication for Critical Function). EPSS is listed at 99.564 percent, placing the flaw at the 100th percentile for exploitation probability within 30 days.
-
update from sentinelone.com
CVE-2026-39987 — Marimo Pre-Auth RCE — SentinelOne Vulnerability Database
sentinelone.com · 188d ago · April 9th, 2026
It notes the affected endpoint /terminal/ws allows unauthenticated attackers to obtain an interactive shell, and confirms versions through 0.20.4 are vulnerable with 0.23.0 as the patched release.
-
update from gbhackers.com
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
gbhackers.com · 28d ago · September 15th, 2026
This vulnerability, tracked as CVE-2026-39987, affects marimo versions up to 0.20.4 and […] The post Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cybersecurefox.com
CVE-2026-39987 Marimo RCE: operator reached SSH bastion in 8 seconds without AI 🔗 https:// cybersecurefox.com/en/cve-2026 -39987-marimo-rce-
cybersecurefox.com · 25d ago · September 18th, 2026
CVE-2026-39987 Marimo RCE: operator reached SSH bastion in 8 seconds without AI 🔗 https:// cybersecurefox.com/en/cve-2026 -39987-marimo-rce-
via Mastodon https://cybersecurefox.com/en/cve-2026-39987-marimo-rce-ssh-bastion-8-seconds