{"id":"marimo-terminal-code-execution-apr-2026","category":"patch","status":"closed","title":"Marimo terminal flaw CVE-2026-39987 exploited to run commands and steal credentials","tldr":"Attackers are exploiting a missing login check in exposed Marimo editable notebooks to run commands and collect credentials. Update to 0.23.0 or later, restrict network access and investigate any previously exposed installation.","summary":"Marimo, a Python notebook tool used for data analysis and development, exposed its editable notebook terminal without enforcing authentication. Attackers who could reach a vulnerable server could run commands with the Marimo process’s permissions, even when its built-in login protection was enabled. Marimo’s advisory lists versions through 0.20.4 as affected; GitHub’s reviewed entry lists all versions before 0.23.0. Both name 0.23.0 as fixed, and Marimo released it on 9 April. Run-mode applications, WebAssembly notebooks and molab are unaffected. Sysdig observed exploitation within ten hours of disclosure, followed by credential collection, database access and backdoor deployment. CISA confirmed exploitation on 23 April, and Sysdig reported another attack in September. As at 3 November, a fix is available, but updating cannot undo earlier credential theft; previously exposed installations need investigation and potentially exposed credentials need replacing.","action":"If you or your organisation use Marimo, ask whoever maintains it to update to 0.23.0 or later and restrict notebook access to trusted networks. Have them investigate any previously exposed installation and replace potentially exposed cloud keys, API tokens and database credentials.","product":"Marimo Python notebook server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-39987"],"tags":["marimo","python","notebook","remote-code-execution","actively-exploited","credential-theft"],"affected":["Marimo <= 0.20.4, according to the vendor advisory; GitHub's reviewed advisory lists < 0.23.0.","Network-accessible editable notebook servers using only Marimo's built-in authentication."],"fixed":["Marimo 0.23.0"],"matches":[],"sources":[{"kind":"advisory","title":"Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass","url":"https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc","by":"Marimo","date":"2026-04-08"},{"kind":"advisory","title":"Marimo 0.23.0 release and security announcement","url":"https://github.com/marimo-team/marimo/releases/tag/0.23.0","by":"Marimo","date":"2026-04-09"},{"kind":"advisory","title":"GitHub reviewed advisory for CVE-2026-39987","url":"https://github.com/advisories/GHSA-2679-6mx9-h9xc","by":"GitHub","date":"2026-04-27"},{"kind":"research","title":"Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours","url":"https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours","by":"Sysdig","date":"2026-04-09"},{"kind":"research","title":"CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace","url":"https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface","by":"Sysdig","date":"2026-04-15"},{"kind":"research","title":"Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit","url":"https://www.sysdig.com/blog/machine-speed-hold-the-ai-hand-rolled-marimo-cve-2026-39987-exploit","by":"Sysdig","date":"2026-09-11"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"}],"started":"2026-04-08","closed":"2026-09-11","created":"2026-11-03T22:22:42.341Z","updated":"2026-11-03T22:22:42.341Z","cve_notes":[{"cve":"CVE-2026-39987","name":"Missing authentication in Marimo's notebook terminal","what":"A missing authentication check in Marimo's editable notebook terminal lets an attacker with network access run system commands with the Marimo process's permissions without logging in.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-09-11","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Sysdig reported another observed attack using the flaw to collect cloud credentials and gain SSH access to a gateway server. The report shows attackers continued targeting the vulnerability months after a fix became available.","url":"https://www.sysdig.com/blog/machine-speed-hold-the-ai-hand-rolled-marimo-cve-2026-39987-exploit","by":"Sysdig","patch":null},{"at":"2026-04-23","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalogue, requiring US federal civilian agencies to act by 7 May. Its catalogue lists ransomware use as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-04-15","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Sysdig reported 662 exploitation events observed from 11–14 April, including credential collection and access to connected databases. It also observed an NKAbuse backdoor variant being deployed on 12 April.","url":"https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface","by":"Sysdig","patch":null},{"at":"2026-04-09T07:31Z","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Sysdig observed exploitation against its honeypots 9 hours and 41 minutes after disclosure. An attacker subsequently collected files containing planted credentials.","url":"https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours","by":"Sysdig","patch":null},{"at":"2026-04-09","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Marimo released 0.23.0 with the security fix. Its release notice identifies editable notebooks exposed to the internet or shared networks as affected; run-mode applications, WebAssembly notebooks and molab are unaffected.","url":"https://github.com/marimo-team/marimo/releases/tag/0.23.0","by":"Marimo","patch":"patched"},{"at":"2026-04-08","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Marimo disclosed CVE-2026-39987, a missing authentication check in its notebook terminal that lets remote attackers run system commands without logging in.","url":"https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc","by":"Marimo","patch":"none"}],"url":"https://hard.fyi/live/marimo-terminal-code-execution-apr-2026/","json":"https://hard.fyi/api/live?id=marimo-terminal-code-execution-apr-2026"}