{"id":"CVE-2026-39987","kind":"vulnerability","aliases":["CVE-2026-39987"],"related":[],"title":"coreweave marimo: marimo is a reactive Python notebook","description":"marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.","summary":"Marimo (Python notebook) /terminal/ws WebSocket endpoint skips authentication, so an unauthenticated attacker gets a full PTY shell as the marimo process user. Exposure needs edit mode (not run/app mode) reachable over a network. Exploited in the wild within hours of disclosure; attackers stole .env secrets, cloud credentials and SSH keys.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-04-23T00:00:00+00:00","products":[{"name":"Marimo Marimo","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"marimo","fixed":["0.23.0"],"affected":"< 0.23.0","ecosystem":"pypi"},{"name":"coreweave marimo","fixed":["0.23.0"],"affected":"< 0.23.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","exploited","marimo","notebooks","poc-public","python","self-hosted"],"not_affected_if":["auth-required","managed-hosting","not-internet-exposed","run-mode","unknown","wasm"],"how_to_check":"Run 'pip show marimo' (or 'marimo --version'); anything below 0.23.0 is vulnerable. Then check whether any instance runs in edit mode ('marimo edit') on the public internet or bound to --host 0.0.0.0 without your own authenticating proxy. Review access logs for connections to /terminal/ws from unknown IPs.","fix":"Upgrade to marimo 0.23.0 or later (pip install -U 'marimo>=0.23.0'). Until then, don't expose edit-mode notebooks: bind to localhost, put an authenticating proxy in front, or run as an app (marimo run). If an exposed instance was reachable, rotate every secret in its environment/.env, cloud keys and SSH keys.","status":"open","published_at":"2026-04-09T18:17:02+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:42+00:00","updated_at":"2026-10-24T07:16:04+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-10-23T20:38:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or upgrade to a fixed Marimo release; the sources do not name the version. If no mitigation exists, stop using the product, per CISA guidance.","reach":"internet","summary":"Marimo, a Python notebook tool, contains a pre-authorization remote code execution flaw. An unauthenticated attacker can get shell access and run arbitrary system commands on the host.","category":"ai-tooling","who_cares":["marimo","python","notebooks"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary commands and gets a shell on the server.","analyst_note":"Find the affected and fixed Marimo versions and the vendor mitigation in the Marimo advisory for CVE-2026-39987; check whether exposure requires a specific run mode such as edit or remote server.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000437,"input_tokens":2526,"output_tokens":369,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed Marimo versions and the vendor mitigation in the Marimo advisory for CVE-2026-39987; check whether exposure requires a specific run mode such as edit or remote server.","search":"'-2026':10A,13A '-39987':11A,14A '/terminal/ws':36B,104C,137C '/ws':128C '0.23.0':91C,159C 'accept':148C 'ai':21B 'ai-tool':20B 'allow':108C 'arbitrari':120C 'attack':44B,74B,111C 'auth':97C,133C 'authent':40B,106C,135C,152C 'call':131C 'check':140C 'cloud':78B 'command':122C 'complet':150C 'connect':149C 'coreweav':1A 'coreweave':18A 'correct':130C 'credenti':79B 'cve':9A,12A 'disclosur':73B 'e.g':127C 'edit':57B 'endpoint':38B,103C,126C,138C 'env':76B 'execut':119C 'exploit':23B,66B 'exposur':55B 'fix':157C 'full':47B,115C 'get':45B 'host':32B 'hour':71B 'key':82B 'lack':105C 'marimo':2A,3A,15A,16A,17A,19A,24B,33B,52B,83C,92C 'mode':58B,61B,143C 'need':56B 'network':65B 'notebook':8A,25B,35B,88C 'obtain':113C 'platform':145C 'poc':27B 'poc-publ':26B 'pre':96C 'pre-auth':95C 'prior':89C 'process':53B 'pti':48B,116C 'public':28B 'python':7A,29B,34B,87C 'rce':98C 'reachabl':62B 'reactiv':6A,86C 'run':142C 'run/app':60B 'secret':77B 'self':31B 'self-host':30B 'shell':49B,117C 'skip':39B,151C 'ssh':81B 'stole':75B 'support':146C 'system':121C 'termin':101C 'tool':22B 'unauthent':43B,110C 'unlik':123C 'user':54B 'valid':107C,132C 'verif':153C 'vulner':99C,155C 'websocket':37B,102C,125C 'wild':69B 'within':70B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-09T18:17:02+00:00","kev":{"dateAdded":"2026-04-23","dueDate":"2026-05-07","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-39987","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39987","severity":null,"published_at":"2026-04-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-39987:22","url":null,"severity":null,"published_at":"2026-10-23T20:40:04+00:00","modified_at":"2026-10-23T20:40:04+00:00","first_seen_at":"2026-10-23T20:40:04+00:00","fetched_at":"2026-10-23T20:40:04+00:00","note":"Vendor advisory GHSA-2679-6mx9-h9xc and 0.23.0 release notes: all marimo < 0.23.0 affected, fixed in 0.23.0; Sysdig saw in-the-wild exploitation 9h41m after disclosure (credential theft); no public PoC at that time."},{"source":"nvd","external_id":"CVE-2026-39987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39987","severity":null,"published_at":"2026-04-09T18:17:02+00:00","modified_at":"2026-06-17T10:42:51+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"github-poc","external_id":"lunacysoft/CVE-2026-39987-POC-Marimo","url":"https://github.com/lunacysoft/CVE-2026-39987-POC-Marimo","severity":null,"published_at":"2026-10-24T06:04:58+00:00","modified_at":null,"first_seen_at":"2026-10-24T06:17:56+00:00","fetched_at":"2026-10-24T06:17:56+00:00","note":null}],"documents":[{"id":856,"url":"https://github.com/advisories/GHSA-2679-6mx9-h9xc","title":"GHSA-2679-6mx9-h9xc Marimo pre-auth RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":857,"url":"https://github.com/marimo-team/marimo/releases/tag/0.23.0","title":"marimo 0.23.0 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":858,"url":"https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours","title":"Sysdig: Marimo RCE exploited in under 10 hours","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2698,"url":"https://github.com/lunacysoft/CVE-2026-39987-POC-Marimo","title":"lunacysoft/CVE-2026-39987-POC-Marimo","kind":"poc","source":"github","text":"CVE-2026-39987 POC Marimo\n\nstars 0","published_at":"2026-10-24T06:04:58+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}