Skip to content

Back to the catalog

Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
sysdig.comwriteup

Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig

Sysdig's Threat Research Team details CVE-2026-39987, a critical (CVSS 9.3) pre-authentication RCE in the marimo Python notebook platform's /terminal/ws WebSocket endpoint, which skips the validate_auth() check used elsewhere in the app and grants an unauthenticated interactive PTY shell. Using honeypots deployed within hours of the advisory, TRT observed a single attacker build a working exploit from the advisory text alone (no public PoC existed), run a scripted PoC validation, manually recon the filesystem, and steal .env AWS credentials and search for SSH keys, all in under 3 minutes, with first exploitation just 9h41m after disclosure. The piece argues niche software (20k GitHub stars) is now exploited as fast as major platforms like Langflow, and provides IOCs and hardening recommendations (upgrade to marimo 0.23.0, restrict/disable the terminal endpoint, rotate credentials).

TL;DR Sysdig TRT honeypots caught an attacker weaponize marimo's unauthenticated /terminal/ws RCE (CVE-2026-39987) from the bare advisory and steal AWS credentials in under 3 minutes, less than 10 hours after disclosure.
Open original ↗
Document

What it is

CVE-2026-39987 (CVSS v4.0 9.3), tracked also as GHSA-2679-6mx9-h9xc, is a pre-authentication RCE in marimo, an open-source reactive Python notebook. The /terminal/ws WebSocket endpoint exposes an interactive PTY shell with no authentication, running as the marimo process. Disclosed April 8, 2026; the Sysdig TRT observed first in-the-wild exploitation 9h41m later.

Preconditions / Affected

  • marimo 0.20.4 and earlier — the summary only names the fix version; the vulnerable ceiling is 0.20.4.
  • A marimo instance reachable over the network with the terminal feature enabled.
  • No credentials, tokens, or session needed — a single WebSocket connection to /terminal/ws yields a shell.

The flaw is asymmetric within the app: /ws and other endpoints call validate_auth(); /terminal/ws skips it entirely.

What to do

  • Upgrade to marimo 0.23.0 or later (fix in PR #9098: github.com/marimo-team/marimo/pull/9098). If you cannot upgrade, restrict network access to /terminal/ws or disable the terminal feature.
  • Rotate secrets on any instance that was publicly reachable — AWS keys, API keys, DB passwords, SSH keys. The observed attacker went straight for .env and ~/.ssh.
  • Detection: monitor for WebSocket connections to /terminal/ws from unexpected sources; legitimate use should be authenticated users on internal networks. The scripted PoC in the wild wraps id in marker strings — watching for these gives a signature:
echo '---POC-START---'
id
echo '---POC-END---'

Attacker behavior worth noting

  • Across the first 12 hours, 125 unique IPs did recon (port scan / HTTP probe) but only one progressed to actual WebSocket exploitation — the terminal step is the meaningful detection point, not the scanning noise.
  • The operator ran the marker-delimited validation script first, then switched to manual filesystem recon and credential theft across four sessions over ~90 minutes. No persistence, no cryptominer, no tooling drop — focused on .env and SSH keys only.

Caveats

  • Sysdig notes the source IP may be a proxy/VPN, not the operator's origin.
  • The page states that at time of writing no CVE number was assigned and marimo is not in CISA KEV — so CVE-based scanning would not flag it. (Sysdig nonetheless references it as CVE-2026-39987 throughout; treat the GHSA advisory as the authoritative tracker for now.)
  • Comparison point: the earlier Langflow flaw (CVE-2026-33017) was exploited within 20 hours with no public PoC; marimo cut that to under half.

Organisations named here

  • GHSA-2679-6mx9-h9xc

CVEs named here

  • CVE-2026-39987
  • CVE-2026-33017

Technologies named here

  • marimo
  • Falco
  • Sysdig Threat Research Team honeypots
  • Zero Day Clock project
  • Python
  • AWS
  • Docker
  • Langflow
  • CISA KEV

Techniques named here

  • Scripted PoC validation
  • Manual filesystem reconnaissance
  • Return-visit verification / history check

Threat actors named here

  • Unnamed attacker

Related in Threat Intel