Marimo · 2026-04-10 · major
Marimo Python Notebook CVE-2026-39987 — Pre-Auth RCE Exploited Within 10 Hours, CISA KEV Listed
An unauthenticated terminal WebSocket endpoint in the popular AI-native Python notebook gave any remote attacker a full shell. Within 9 hours 41 minutes of disclosure, attackers were stealing credentials from .env files. 662 exploit events across 4 days; CISA added to KEV April 23.
The AI-native Python notebook used by thousands of data scientists had a pre-auth shell endpoint — and attackers found it faster than most teams could patch.
What is it?
CVE-2026-39987 (CVSS 9.3) is a pre-authenticated remote code execution flaw in Marimo — an open-source, reactive Python notebook popular in ML and AI development workflows.
How does it work?
Marimo's /terminal/ws WebSocket endpoint, used for its built-in terminal feature, skipped authentication entirely. While other endpoints called validate_auth(), this one only checked 'running mode and platform support,' granting any remote user a full PTY shell. No credentials required.
Why does it matter?
Sysdig's threat research team observed the first exploit attempt 9 hours and 41 minutes after disclosure — with no public PoC code at the time. Attackers manually explored compromised environments, stealing .env credentials and SSH keys within 3 minutes of gaining access. A later-identified NKAbuse botnet variant used the exploit for command-and-control, generating 662 exploitation events between April 11–14 from 11 IPs across 10 countries. CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog on April 23, requiring federal agencies to remediate by May 7.
Who is it for?
Any team running Marimo ≤ 0.20.4 must upgrade to 0.23.0 immediately. Teams exposing Marimo notebooks over a network should audit logs for /terminal/ws access from untrusted IPs.