Marimo CVE-2026-39987 RCE exploited to bastion in 8s[9]

A recent intrusion observed by Sysdig’s Threat Research Team shows just how quickly a skilled human attacker can weaponize Marimo’s critical remote code execution flaw, pivoting from an exposed WebSocket terminal to an internal SSH bastion host in only eight seconds.^[9][7][15]

According to Sysdig, the attacker first connected to the Marimo notebook server’s unauthenticated terminal endpoint, obtained an interactive shell, and then harvested cloud credentials from the compromised host.^[9][15] Those credentials were used to call AWS Secrets Manager, retrieve an SSH private key, and drive a new SSH session into a downstream bastion used to protect internal infrastructure, all within a single, tightly scripted chain of commands rather than any autonomous AI tooling.^[9][14][15]

The entry point for the attack is CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo’s /terminal/ws WebSocket endpoint that skips authentication checks before spawning a PTY-backed shell.^[1][3][8] Multiple analyses describe the bug as critical, with a CVSS v3.1 score of 9.3, reflecting the fact that any unauthenticated network client can obtain a full interactive shell running with the Marimo process’s privileges, often root in default containerized deployments.^[5][3][4] Vendor security notes and community advisories indicate that Marimo releases from roughly 0.7.10 through at least 0.20.4 are vulnerable, with a fix landing in version 0.23.0 and later builds tightening terminal authentication.^{[12][3][8][1]}

Exploitation of CVE-2026-39987 has moved quickly from proof-of-concept to real-world attacks. Researchers report that opportunistic actors began abusing the bug within hours of its public disclosure, with one campaign using exposed Marimo servers to deploy a blockchain-controlled botnet payload hosted on AI infrastructure.^[7][5] Public exploit code is now available in multiple forms, including detailed technical write-ups and tools on community repositories and exploit databases, lowering the barrier for less sophisticated attackers to reproduce the shell-on-connect behavior.^[2][6][8]

Threat intelligence teams have also documented more complex operations chaining Marimo compromise into cloud and data-center pivots. One case study describes an unknown actor who exploited CVE-2026-39987, launched an autonomous LLM agent to enumerate credentials and services, and completed four separate pivots—including SSH bastion access and full PostgreSQL database exfiltration—in just under two minutes.^[13][14][15] Together with Sysdig’s eight-second manual intrusion, these incidents underscore that both human operators and automation can reach “machine speed” when critical pre-auth RCEs are left exposed to the internet.^[9][13]

For defenders, the takeaway is that Marimo deployments should not be treated as low-risk developer tooling when they sit on flat, internet-reachable networks. Security researchers warn that a single misconfigured instance can provide attackers with direct shell access, cloud credential harvesting opportunities, and a launchpad for lateral movement across containers and virtual machines.^[5][11][9] Organizations running Marimo are advised to upgrade to 0.23.0 or newer to address CVE-2026-39987, and to 0.23.15 or later to remediate a separate code injection RCE tracked as CVE-2026-75149.^[1][8][10] Until patches are fully deployed, hardening guidance emphasizes restricting access to the terminal WebSocket, placing notebook servers behind VPNs or zero-trust gateways, and running Marimo inside tightly constrained containers or accounts to limit the blast radius of any successful exploit.^[5][12][10]

References

1. NVD-CVE-2026-39987 – NIST
2. Root in One Request: Marimo’s Critical Pre-Auth RCE …
3. CVE-2026-39987, Marimo: Pre-Auth Remote Code …
4. 92339 / CVE-2026-39987 — Safety Vulnerability Database
5. Marimo Pre-Auth RCE Weaponized for Blockchain Botnet
6. OffSec’s Exploit Database Archive
7. Marimo OSS Python Notebook RCE: From Disclosure to …
8. CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE … – GitHub
9. Machine speed, hold the AI: Hand-rolled marimo CVE …
10. CVE-2026-75149: marimo Code Injection RCE Vulnerability
11. Marimo Pre-Auth RCE via Unauthenticated WebSocket …
12. Security
13. Threat Intelligence | Vectimus
14. Sysdig Documents First Confirmed Autonomous Llm Agent Cyberattack Four Pivots Aws Database Exfil intelligence trail
15. Attackers Use LLM Agent for Post-Exploitation After Marimo …