Executive Summary
In April 2026, a critical pre-authentication remote code execution (RCE) vulnerability, identified as CVE-2026-39987, was discovered in Marimo, a popular open-source Python notebook platform. This flaw allowed unauthenticated attackers to gain full PTY shell access via the /terminal/ws WebSocket endpoint, enabling arbitrary system command execution. Exploitation was observed within 10 hours of public disclosure, with attackers swiftly leveraging the vulnerability to exfiltrate sensitive information. The issue affected all Marimo versions up to 0.20.4 and was addressed in version 0.23.0. (thehackernews.com)
The rapid exploitation of CVE-2026-39987 underscores the critical need for immediate patching and vigilant monitoring of open-source tools. This incident highlights the growing trend of attackers targeting vulnerabilities in widely-used development platforms, emphasizing the importance of proactive security measures in software development environments.
Why This Matters Now
The swift exploitation of CVE-2026-39987 within hours of disclosure highlights the urgency for organizations to promptly patch vulnerabilities in widely-used open-source tools like Marimo. This incident serves as a stark reminder of the increasing speed at which threat actors operate, emphasizing the need for immediate and proactive security measures to protect sensitive data and maintain system integrity.
Attack Path Analysis
An unauthenticated attacker exploited a critical vulnerability in Marimo's WebSocket endpoint to gain initial access, executed commands to harvest credentials, and potentially moved laterally within the network. The attacker established command and control through the compromised system, exfiltrated sensitive data, and could have caused further impact by deploying additional malware or disrupting services.
Kill Chain Progression
Initial Compromise
Description
The attacker exploited the unauthenticated /terminal/ws WebSocket endpoint in Marimo to gain a full interactive shell on the host system.
Related CVEs
CVE-2026-39987
CVSS 9.3A pre-authentication remote code execution vulnerability in Marimo's terminal WebSocket endpoint allows unauthenticated attackers to execute arbitrary system commands.
Affected Products:
Marimo Team Marimo – <= 0.20.4
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Unix Shell
Valid Accounts
OS Credential Dumping
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical pre-auth RCE vulnerability in Marimo Python notebooks enables credential theft, affecting IT infrastructure managing data science platforms and development environments.
Health Care / Life Sciences
Marimo exploitation threatens HIPAA compliance through unauthorized terminal access, enabling exfiltration of sensitive healthcare data and research credentials within minutes.
Financial Services
RCE flaw allows attackers to harvest cloud credentials and application secrets from financial data analysis platforms, compromising PCI compliance requirements.
Higher Education/Acadamia
Academic institutions using Marimo for research and ML education face rapid credential theft attacks targeting SSH keys and environment variables.
Sources
- Critical Marimo pre-auth RCE flaw now under active exploitationhttps://www.bleepingcomputer.com/news/security/critical-marimo-pre-auth-rce-flaw-now-under-active-exploitation/Verified
- NVD - CVE-2026-39987https://nvd.nist.gov/vuln/detail/CVE-2026-39987Verified
- Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypasshttps://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xcVerified
- Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hourshttps://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hoursVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's initial access would likely be constrained by enforcing strict segmentation policies, reducing the ability to exploit vulnerable endpoints.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained by limiting access to sensitive credentials through strict segmentation.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement would likely be constrained by monitoring and controlling east-west traffic, reducing unauthorized access between systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's command and control channels would likely be constrained by providing comprehensive visibility and control over network traffic.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely be constrained by enforcing strict egress policies, reducing unauthorized data transfers.
The potential impact of deploying additional malware or disrupting services would likely be constrained by limiting the attacker's ability to execute malicious actions.
Impact at a Glance
Affected Business Functions
- Data Analysis
- Machine Learning Model Development
- Research Collaboration
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive research data, proprietary algorithms, and intellectual property.
Recommended Actions
Key Takeaways & Next Steps
- • Upgrade Marimo to version 0.23.0 or later to remediate the vulnerability.
- • Implement Zero Trust Segmentation to restrict access to critical systems and limit lateral movement.
- • Deploy East-West Traffic Security controls to monitor and control internal network traffic.
- • Utilize Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities.
- • Enforce Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
