CVE-2026-39987 represents a critical pre-authenticated remote code execution vulnerability affecting Marimo, an open-source reactive Python notebook platform widely used for data science, analysis, and interactive coding workflows.
This vulnerability, carrying a CVSS score of 9.3, impacts all Marimo versions prior to 0.23.0 and stems from a complete absence of authentication validation on the /terminal/ws WebSocket endpoint. This authentication bypass allows any unauthenticated remote attacker to obtain a full PTY (pseudo-terminal) shell and execute arbitrary system commands on vulnerable Marimo instances through a single WebSocket connection, without requiring any credentials, user interaction, or prior compromise.
The vulnerability was publicly disclosed on April 8, 2026, through a security advisory that detailed the technical root cause and exploitation methodology. Remarkably, active exploitation in the wild was observed within just 9 hours and 41 minutes of the advisory's publication, demonstrating the rapidly shrinking window between vulnerability disclosure and weaponization.
This extremely brief time-to-exploit window occurred without any public proof-of-concept code being available, indicating that attackers crafted working exploits directly from the advisory's technical description alone.
Security researchers operating honeypot infrastructure detected the first exploitation attempt when an attacker connected to the unauthenticated terminal WebSocket endpoint and conducted manual reconnaissance activities across four distinct sessions spanning approximately 90 minutes.
The attacker's activities focused primarily on credential harvesting and data collection rather than deployment of persistent malware, cryptominers, or backdoors. Specific attacker objectives included:
.env environment files commonly used in Python development workflowsThe vulnerability's root cause lies in inconsistent security control implementation across Marimo's WebSocket endpoints. While other endpoints such as /ws properly invoke the validate_auth() authentication function, the /terminal/ws endpoint completely bypasses this validation step.
The impact severity extends significantly beyond simple server compromise. Marimo environments frequently store sensitive API keys for Large Language Model providers (OpenAI, Anthropic, Cohere, etc.) as well as cloud service credentials for AWS, Google Cloud Platform, and Azure infrastructure.
Exfiltration of these credentials could enable:
The observed exploitation pattern suggests professional threat actor involvement rather than opportunistic scanning. The attacker demonstrated:
Organizations running Marimo face immediate risk requiring emergency remediation.
CVE-2026-39987 exists due to architectural inconsistency in authentication enforcement across Marimo's WebSocket endpoint implementations.
/ws) invoke validate_auth() before granting access/terminal/ws endpoint omits authentication entirelyThis allows unauthenticated attackers to establish WebSocket connections and gain full terminal access.
Upon connection, attackers receive a full PTY shell with the privileges of the Marimo process user, enabling:
No public proof-of-concept code was available during initial exploitation.
The attacker:
.env credentialsNotably, the attacker did NOT:
This indicates targeted credential harvesting.
The impact extends beyond server compromise due to sensitive data stored in Marimo environments.
Marimo version 0.23.0 fixes the vulnerability by enforcing authentication on /terminal/ws.
All organizations must upgrade without delay.
If not possible:
/terminal/ws accessAudit all accessible credentials:
.env files and environment variables.ssh directories)Action: Rotate all credentials—even without confirmed compromise.
Notebook platforms should never be exposed without protection.
0.0.0.0 unless securedFor containerized deployments:
Monitor for:
/terminal/ws connectionsKey Insight: Any external /terminal/ws access is a high-confidence indicator of compromise.
