# Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987)

> Critical pre-authentication remote code execution in Marimo reactive Python notebook (all versions < 0.23.0) via unauthenticated /terminal/ws WebSocket endpoint. CVSS 9.3 Critical. Active exploitation confirmed within 9 hours 41 minutes of disclosure with credential theft completed in under 3 minutes. CISA KEV listed. Patched in 0.23.0.

- **Published:** 2026-04-12T12:00:00Z
- **Last reviewed:** 2026-04-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0352
- **ID:** TL-2026-0352
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-39987

## Description

CVE-2026-39987 (GHSA-2679-6mx9-h9xc) is a critical pre-authentication remote code execution vulnerability in Marimo, an open-source reactive Python notebook platform with approximately 20,000 GitHub stars, widely used by data scientists, ML/AI practitioners, and analysts.

The vulnerability resides in the terminal WebSocket endpoint at /terminal/ws within marimo/_server/api/endpoints/terminal.py (lines 340-356). Marimo's server implements authentication enforcement inconsistently across its WebSocket endpoints: the primary notebook communication endpoint /ws correctly invokes the application's WebSocketConnectionValidator.validate_auth() function, but the terminal WebSocket endpoint /terminal/ws performs no equivalent authentication check. The endpoint only validates that the application supports terminal mode and that the platform supports PTY allocation before calling websocket.accept(), completely bypassing authentication verification. This allows any unauthenticated attacker to complete a WebSocket handshake and obtain a full interactive PTY shell executing commands as the Marimo process user — typically root in default Docker deployments.

Marimo uses Starlette's AuthenticationMiddleware, but this middleware-level protection is insufficient because it marks connections as unauthenticated without rejecting WebSocket upgrades outright, meaning the application-level validate_auth() check is the actual enforcement point that was missing on the terminal endpoint.

The Sysdig Threat Research Team observed active exploitation in their honeypot infrastructure beginning just 9 hours and 41 minutes after the GitHub security advisory was published on April 8, 2026 at 21:50 UTC. The threat actor, operating from IP 49.207.56.74 (geolocated to India, likely a proxy/VPN), conducted four distinct sessions: (1) at 07:31 UTC on April 9, scripted PoC validation using markers and the id command; (2) at 07:33 UTC, manual filesystem reconnaissance using pwd, whoami, ls, and cd; (3) at 07:43 UTC, targeted credential harvesting extracting .env files containing AWS API keys, completed in under 3 minutes; and (4) at 08:57 UTC, a return visit repeating PoC validation and .env exfiltration. The attacker also targeted SSH keys (~/.ssh) and Docker configuration files (docker-compose.yml). No malware, cryptocurrency miners, or persistence mechanisms were deployed — the operation was purely focused on credential theft.

Notably, no public proof-of-concept exploit code existed at the time of first exploitation — the attacker built a working exploit directly from the advisory description, demonstrating the trivial exploitability of this flaw. The behavior pattern — manual interaction, pauses between sessions, methodical file enumeration — is consistent with a human operator working through a target list.

Endor Labs researchers tested 186 internet-reachable Marimo instances and found 30 (approximately 16%) accepted unauthenticated WebSocket handshakes, all running in edit mode. Additionally, 125 unique IP addresses were observed conducting port scanning and HTTP probing for vulnerable Marimo instances.

CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 11, 2026. The Marimo team released version 0.23.0 on April 11, 2026 via pull request #9098 (commit c24d4806398f30be6b12acd6c60d1d7c68cfd12a), which closes the authentication gap by aligning the terminal WebSocket validation with the logic applied to other endpoints.

This vulnerability is part of a concerning trend of rapid exploitation of AI development toolchain software. It is the third documented critical AI toolchain RCE in 6 months, following Langflow (CVE-2026-33017, exploited in <20 hours) and Flowise (CVE-2025-59528). Compromised Marimo instances typically expose high-value credentials including OpenAI, Anthropic, and Google Gemini API keys, cloud provider credentials (AWS, GCP, Azure), and access tokens for fine-tuned models and training datasets.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1070 Indicator Removal
- T1587 Develop Capabilities

## Sources

- [GitHub Security Advisory — GHSA-2679-6mx9-h9xc](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc)
- [NVD — CVE-2026-39987](https://nvd.nist.gov/vuln/detail/CVE-2026-39987)
- [Sysdig — Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours](https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours)
- [Endor Labs — Root in One Request: Marimo Critical Pre-Auth RCE](https://www.endorlabs.com/learn/root-in-one-request-marimos-critical-pre-auth-rce-cve-2026-39987)
- [The Hacker News — Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure](https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html)
- [SecurityWeek — Critical Marimo Flaw Exploited Hours After Public Disclosure](https://www.securityweek.com/critical-marimo-flaw-exploited-hours-after-public-disclosure/)
- [Security Affairs — CVE-2026-39987: Marimo RCE Exploited in Hours After Disclosure](https://securityaffairs.com/190623/hacking/cve-2026-39987-marimo-rce-exploited-in-hours-after-disclosure.html)
- [BleepingComputer — Critical Marimo Pre-Auth RCE Flaw Now Under Active Exploitation](https://www.bleepingcomputer.com/news/security/critical-marimo-pre-auth-rce-flaw-now-under-active-exploitation/)
- [CSA Lab Space — Marimo Pre-Auth RCE: AI Development Toolchain Under Attack](https://labs.cloudsecurityalliance.org/research/csa-research-note-marimo-rce-cve-2026-39987-ai-toolchain-202/)
- [Marimo Patch — PR #9098 Terminal WebSocket Authentication Fix](https://github.com/marimo-team/marimo/pull/9098)
- [Marimo Patch Commit — c24d4806](https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a)
- [CIRCL Vulnerability Lookup — GHSA-2679-6mx9-h9xc](https://vulnerability.circl.lu/vuln/ghsa-2679-6mx9-h9xc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0352