Marimo terminal flaw CVE-2026-39987 exploited to run commands and steal credentials
Attackers are exploiting a missing login check in exposed Marimo editable notebooks to run commands and collect credentials. Update to 0.23.0 or later, restrict network access and investigate any previously exposed installation.
If you or your organisation use Marimo, ask whoever maintains it to update to 0.23.0 or later and restrict notebook access to trusted networks. Have them investigate any previously exposed installation and replace potentially exposed cloud keys, API tokens and database credentials.
What’s happening
Marimo, a Python notebook tool used for data analysis and development, exposed its editable notebook terminal without enforcing authentication. Attackers who could reach a vulnerable server could run commands with the Marimo process’s permissions, even when its built-in login protection was enabled. Marimo’s advisory lists versions through 0.20.4 as affected; GitHub’s reviewed entry lists all versions before 0.23.0. Both name 0.23.0 as fixed, and Marimo released it on 9 April. Run-mode applications, WebAssembly notebooks and molab are unaffected. Sysdig observed exploitation within ten hours of disclosure, followed by credential collection, database access and backdoor deployment. CISA confirmed exploitation on 23 April, and Sysdig reported another attack in September. As at 3 November, a fix is available, but updating cannot undo earlier credential theft; previously exposed installations need investigation and potentially exposed credentials need replacing.
- What
- Flaw
- Affects
- Marimo Python notebook server
- Affected
- Marimo <= 0.20.4, according to the vendor advisory; GitHub's reviewed advisory lists < 0.23.0.
Network-accessible editable notebook servers using only Marimo's built-in authentication. - Fixed in
- Marimo 0.23.0
- Since
- 8 Apr 2026
- Closed
- 11 Sept 2026
Timeline
- Wider attacks
Sysdig reported another observed attack using the flaw to collect cloud credentials and gain SSH access to a gateway server. The report shows attackers continued targeting the vulnerability months after a fix became available.
- CISA added
CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalogue, requiring US federal civilian agencies to act by 7 May. Its catalogue lists ransomware use as unknown.
- Wider attacks
Sysdig reported 662 exploitation events observed from 11–14 April, including credential collection and access to connected databases. It also observed an NKAbuse backdoor variant being deployed on 12 April.
- Wider attacks
Sysdig observed exploitation against its honeypots 9 hours and 41 minutes after disclosure. An attacker subsequently collected files containing planted credentials.
- New fixFixed
Marimo released 0.23.0 with the security fix. Its release notice identifies editable notebooks exposed to the internet or shared networks as affected; run-mode applications, WebAssembly notebooks and molab are unaffected.
- Made publicNo fix yet
Marimo disclosed CVE-2026-39987, a missing authentication check in its notebook terminal that lets remote attackers run system commands without logging in.
Sources
- Pre-Auth Remote Code Execution via Terminal WebSocket Authentication BypassMarimo · 8 Apr 2026
- Marimo 0.23.0 release and security announcementMarimo · 9 Apr 2026
- GitHub reviewed advisory for CVE-2026-39987GitHub · 27 Apr 2026
- Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 HoursSysdig · 9 Apr 2026
- CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFaceSysdig · 15 Apr 2026
- Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploitSysdig · 11 Sept 2026
- Known Exploited Vulnerabilities catalogueCISA · 3 Nov 2026