Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987)
Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (TL-2026-0352), also tracked as GHSA-2679-6mx9-h9xc, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-04-12. It has no confirmed attribution, affects marimo-team Marimo, references 1 CVE (CVE-2026-39987), maps to 11 MITRE ATT&CK techniques (T1005, T1033, T1041), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0352
- Threat ID
- TL-2026-0352
- Also known as
- GHSA-2679-6mx9-h9xc
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-12
- Last reviewed
- 2026-04-12
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, data-science, artificial-intelligence, research, education, financial, healthcare, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
Malware and tooling: WebSocket-based interactive terminal (no traditional C2)
Critical pre-authentication remote code execution in Marimo reactive Python notebook (all versions < 0.23.0) via unauthenticated /terminal/ws WebSocket endpoint. CVSS 9.3 Critical. Active exploitation confirmed within 9 hours 41 minutes of disclosure with credential theft completed in under 3 minutes. CISA KEV listed. Patched in 0.23.0.
How Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal works
CVE-2026-39987 (GHSA-2679-6mx9-h9xc) is a critical pre-authentication remote code execution vulnerability in Marimo, an open-source reactive Python notebook platform with approximately 20,000 GitHub stars, widely used by data scientists, ML/AI practitioners, and analysts.
The vulnerability resides in the terminal WebSocket endpoint at /terminal/ws within marimo/_server/api/endpoints/terminal.py (lines 340-356). Marimo's server implements authentication enforcement inconsistently across its WebSocket endpoints: the primary notebook communication endpoint /ws correctly invokes the application's WebSocketConnectionValidator.validate_auth() function, but the terminal WebSocket endpoint /terminal/ws performs no equivalent authentication check. The endpoint only validates that the application supports terminal mode and that the platform supports PTY allocation before calling websocket.accept(), completely bypassing authentication verification. This allows any unauthenticated attacker to complete a WebSocket handshake and obtain a full interactive PTY shell executing commands as the Marimo process user — typically root in default Docker deployments.
Marimo uses Starlette's AuthenticationMiddleware, but this middleware-level protection is insufficient because it marks connections as unauthenticated without rejecting WebSocket upgrades outright, meaning the application-level validate_auth() check is the actual enforcement point that was missing on the terminal endpoint.
The Sysdig Threat Research Team observed active exploitation in their honeypot infrastructure beginning just 9 hours and 41 minutes after the GitHub security advisory was published on April 8, 2026 at 21:50 UTC. The threat actor, operating from IP 49.207.56.74 (geolocated to India, likely a proxy/VPN), conducted four distinct sessions: (1) at 07:31 UTC on April 9, scripted PoC validation using markers and the id command; (2) at 07:33 UTC, manual filesystem reconnaissance using pwd, whoami, ls, and cd; (3) at 07:43 UTC, targeted credential harvesting extracting .env files containing AWS API keys, completed in under 3 minutes; and (4) at 08:57 UTC, a return visit repeating PoC validation and .env exfiltration. The attacker also targeted SSH keys (~/.ssh) and Docker configuration files (docker-compose.yml). No malware, cryptocurrency miners, or persistence mechanisms were deployed — the operation was purely focused on credential theft.
Notably, no public proof-of-concept exploit code existed at the time of first exploitation — the attacker built a working exploit directly from the advisory description, demonstrating the trivial exploitability of this flaw. The behavior pattern — manual interaction, pauses between sessions, methodical file enumeration — is consistent with a human operator working through a target list.
Endor Labs researchers tested 186 internet-reachable Marimo instances and found 30 (approximately 16%) accepted unauthenticated WebSocket handshakes, all running in edit mode. Additionally, 125 unique IP addresses were observed conducting port scanning and HTTP probing for vulnerable Marimo instances.
CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 11, 2026. The Marimo team released version 0.23.0 on April 11, 2026 via pull request #9098 (commit c24d4806398f30be6b12acd6c60d1d7c68cfd12a), which closes the authentication gap by aligning the terminal WebSocket validation with the logic applied to other endpoints.
This vulnerability is part of a concerning trend of rapid exploitation of AI development toolchain software. It is the third documented critical AI toolchain RCE in 6 months, following Langflow (CVE-2026-33017, exploited in <20 hours) and Flowise (CVE-2025-59528). Compromised Marimo instances typically expose high-value credentials including OpenAI, Anthropic, and Google Gemini API keys, cloud provider credentials (AWS, GCP, Azure), and access tokens for fine-tuned models and training datasets.
MITRE ATT&CK techniques used in TL-2026-0352
Collection
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter
Defense Evasion
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
Resource Development
Reconnaissance
Affected products and versions in Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
- marimo-team — Marimo
Vulnerable versions: All versions < 0.23.0; 0.20.4 and earlier explicitly confirmed
Fixed in: 0.23.0
Remediation for Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
Patches
- Marimo v0.23.0 — PR #9098, commit c24d4806398f30be6b12acd6c60d1d7c68cfd12a
Immediate actions
- Upgrade Marimo to version 0.23.0 or later immediately
- If running internet-exposed Marimo instances prior to upgrade, assume compromise and initiate incident response
- Rotate all accessible credentials: LLM API keys (OpenAI, Anthropic, Google), cloud provider credentials (AWS, GCP, Azure), SSH keys
- Review WebSocket /terminal/ws access logs from April 8, 2026 onward for unauthorized connections
- Block known exploitation source IP 49.207.56.74 at perimeter
Workarounds
- Do not bind Marimo to 0.0.0.0 without explicit network controls
- Restrict Marimo edit mode to trusted networks (VPNs, private subnets, authenticated proxies)
- Deploy WAF rules blocking unauthenticated WebSocket upgrades to /terminal/ws
- Use container network policies to limit egress from Marimo containers
Longer-term hardening
- Deploy reverse-proxy authentication in front of Marimo (Nginx OAuth2, Cloudflare Access, AWS ALB)
- Run Marimo containers as non-root users with read-only filesystems
- Migrate secrets from .env files to cloud provider secret managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault)
- Implement network-level access controls restricting Marimo port 2718 to trusted IPs/VPNs only
- Integrate AI development tooling into vulnerability management and asset inventory programs
- Apply Zero Trust network access controls before all notebook/development tool ports
- Subscribe to GitHub security advisory feeds for AI toolchain projects
CVEs associated with Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
Weaknesses (CWE) in Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
CWE-306
Timeline of Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
- GitHub security advisory GHSA-2679-6mx9-h9xc published at 21:50 UTC, disclosing the unauthenticated terminal WebSocket RCE in Marimo. Reported by security researcher q1uf3ng.
- CISA adds CVE-2026-39987 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 11, 2026.
- CVE-2026-39987 assigned by NVD with CVSS v4.0 score of 9.3 Critical. CWE-306 (Missing Authentication for Critical Function) classification applied.
- At 08:57 UTC, attacker returned approximately 90 minutes later to repeat PoC validation and .env exfiltration, consistent with a human operator working through a target list.
- At 07:43 UTC, attacker harvested .env files containing AWS API keys, targeted SSH keys (~/.ssh), and read Docker configuration files. Full credential theft completed in under 3 minutes.
- At 07:33 UTC, attacker conducted manual filesystem reconnaissance using pwd, whoami, ls, and cd commands on compromised Marimo instance.
- First in-the-wild exploitation observed by Sysdig Threat Research Team honeypot at 07:31 UTC — just 9 hours 41 minutes after advisory publication. Attacker from IP 49.207.56.74 performed scripted PoC validation.
- 125+ unique IP addresses observed conducting port scanning and HTTP probing for vulnerable Marimo instances. Endor Labs identifies 186 internet-reachable instances, 30 (16%) accepting unauthenticated WebSocket handshakes.
- Marimo version 0.23.0 released with fix via PR #9098 (commit c24d4806398f30be6b12acd6c60d1d7c68cfd12a), aligning terminal WebSocket authentication with other endpoint validation.
- BleepingComputer, The Hacker News, SecurityWeek, Security Affairs, and CSA Lab Space publish detailed analyses of the vulnerability and active exploitation campaign.
- As of 2026-05-29, CVE-2026-39987 (Marimo pre-auth RCE) is patched in 0.23.0 but under escalating active exploitation against unpatched internet-exposed instances. Sysdig logged 662 exploit events (Apr 11-14), NKAbuse blockchain botnet delivery via typosquatted Hugging Face Spaces, and a May 10 LLM-agent-driven AWS/PostgreSQL pivot; CISA KEV deadline was May 7.
Sources cited for Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal
- GitHub Security Advisory — GHSA-2679-6mx9-h9xc
- NVD — CVE-2026-39987
- Sysdig — Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours
- Endor Labs — Root in One Request: Marimo Critical Pre-Auth RCE
- The Hacker News — Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure
- SecurityWeek — Critical Marimo Flaw Exploited Hours After Public Disclosure
- Security Affairs — CVE-2026-39987: Marimo RCE Exploited in Hours After Disclosure
- BleepingComputer — Critical Marimo Pre-Auth RCE Flaw Now Under Active Exploitation
- CSA Lab Space — Marimo Pre-Auth RCE: AI Development Toolchain Under Attack
- Marimo Patch — PR #9098 Terminal WebSocket Authentication Fix
- Marimo Patch Commit — c24d4806
- CIRCL Vulnerability Lookup — GHSA-2679-6mx9-h9xc
More in vulnerability
- CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument Injection
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection
- CVE-2025-37947: Out-of-Bounds Write in Linux ksmbd Kernel SMB Server Enables Local Privilege Escalation
- Dell ObjectScale Critical Deserialization Flaw (CVE-2026-70416, CVSS 10.0) Enables Unauthenticated RCE
Detection coverage for TL-2026-0352
As of 2026-04-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0352 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.