Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987) — Threadlinqs Intelligence
As of 2026-05-30, Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987) is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0352 · Severity: CRITICAL · CVSS: 9.3 · Status: ACTIVE · Category: VULNERABILITY
Attribution: N/A · FINANCIAL
Critical pre-authentication remote code execution in Marimo reactive Python notebook (all versions < 0.23.0) via unauthenticated /terminal/ws WebSocket endpoint. CVSS 9.3 Critical. Active exploitation
CVE-2026-39987 (GHSA-2679-6mx9-h9xc) is a critical pre-authentication remote code execution vulnerability in Marimo, an open-source reactive Python notebook platform with approximately 20,000 GitHub stars, widely used by data scientists, ML/AI practitioners, and analysts.
The vulnerability resides in the terminal WebSocket endpoint at /terminal/ws within marimo/_server/api/endpoints/terminal.py (lines 340-356). Marimo's server implements authentication enforcement inconsistently across its WebSocket endpoints: the primary notebook communication endpoint /ws correctly invokes the application's WebSocketConnectionValidator.validate_auth() function, but the terminal WebSocket endpoint /terminal/ws performs no equivalent authentication check. The endpoint only validates that the application supports terminal mode and that the platform supports PTY allocation before calling websocket.accept(), completely bypassing authentication verification. This allows any unauthenticated attacker to complete a WebSocket handshake and obtain a full interactive PTY shell executing commands as the Marimo process user — typically root in default Docker deployments.
Marimo uses Starlette's AuthenticationMiddleware, but this middleware-level protection is insufficient because it marks connections as unauthenticated without rejecting WebSocket upgrades outright, meaning the application-level validate_auth() check is the actual enforcement point that was missing on the terminal endpoint.
The Sysdig Threat Research Team observed active exploitation in their honeypot infrastructure beginning just 9 hours and 41 minutes after the GitHub security advisory was published on April 8, 2026 at 21:50 UTC. The threat actor, operating from IP 49.207.56.74 (geolocated to India, likely a proxy/VPN), conducted four distinct sessions: (1) at 07:31 UTC on April 9, scripted PoC validation using markers and the id command; (2) at 07:33 UTC, manual filesystem reconnaissance using pwd, whoami, ls, and cd; (3) at 07:43 UTC, targeted credential harvesting extracting .env files containing AWS API keys, completed in under 3 minutes; and (4) at 08:57 UTC, a return visit repeating PoC validation and .env exfiltration. The attacker also targeted SSH keys (~/.ssh) and Docker configuration files (docker-compose.yml). No malware, cryptocurrency miners, or persistence mechanisms were deployed — the operation was purely focused on credential theft.
Notably, no public proof-of-concept exploit code existed at the time of first exploitation — the attacker built a working exploit directly from the advisory description, demonstrating the trivial exploitability of this flaw. The behavior pattern — manual interaction, pauses between sessions, methodical file enumeration — is consistent with a human operator working through a target list.
Endor Labs researchers tested 186 internet-reachable Marimo instances and found 30 (approximately 16%) accepted unauthenticated WebSocket handshakes, all running in edit mode. Additionally, 125 unique IP addresses were observed conducting port scanning and HTTP probing for vulnerable Marimo instances.
CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 11, 2026. The Marimo team released version 0.23.0 on April 11, 2026 via pull request #9098 (commit c24d4806398f30be6b12acd6c60d1d7c68cfd12a), which closes the authentication gap by aligning the terminal WebSocket validation with the logic applied to other endpoints.
This vulnerability is part of a concerning trend of rapid exploitation of AI development toolchain software. It is the third documented critical AI toolchain RCE in 6 months, following Langflow (CVE-2026-33017, exploited in <20 hours) and Flowise (CVE-2025-59528). Compromised Marimo instances typically expose high-value credentials including OpenAI, Anthropic, and Google Gemini API keys, cloud provider credentials (AWS, GCP, Azure), and access tokens for fine-tuned models and training
Target sectors: technology, data-science, artificial-intelligence, research, education, financial, healthcare, cloud-services
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-39987, T1595, T1595, T1190, T1059, T1083, T1033, T1082, T1552, T1552, T1005