Marimo WebSocket RCE abused after CVE-2026-39987 disclosure
Case score 66
Case score is a discovery signal based on public evidence, not a guaranteed risk rating. Use it to decide what to review first, then verify important details from the linked sources.
- Total
- 66
- Main story score
- 63
- Related evidence lift
- +3 / 20
- Contributing updates
- 1
- Context updates
- 0
- Vulnerability Provides the pre-authenticated RCE, early abuse within hours of disclosure, and file-seeking behavior on exposed Marimo systems. main
- Exploitation Wave Adds broader reconnaissance, credential-theft behavior, and remediation context tied to the same Marimo CVE and endpoint. contributes
Overview
Latest development Open development history Marimo discloses CVE-2026-39987 and early exploitation is observed Marimo identified CVE-2026-39987 as a CVSS 9.3 pre-authenticated remote code execution flaw in the /terminal/ws WebSocket endpoint, affecting all versions prior to and including 0.20.4 and fixed in 0.23.0; Sysdig then observed exploitation shortly after public disclosure, including a full PTY shell, manual reconnaissance, attempts to harvest .env data and SSH keys, and no proof-of-concept code available at the time.
-
Marimo releases version 0.23.0 to fix CVE-2026-39987
Marimo released version 0.23.0 to address CVE-2026-39987 and advised users to upgrade immediately; if upgrading is not possible, external access to '/terminal/ws' should be blocked or disabled and exposed secrets should be rotated.
-
Sysdig reports hands-on exploitation and credential theft
Sysdig researchers reported active exploitation that began less than 10 hours after disclosure, with 125 IP addresses starting reconnaissance within the first 12 hours. The first exploitation attempt validated remote code execution at '/terminal/ws', then continued with manual reconnaissance using pwd, whoami, and ls before targeting .env files, cloud credentials, application secrets, and SSH keys; the credential access phase finished in less than three minutes and no persistence was attempted.