Critical Pre‑Auth RCE (CVE‑2026‑39987) in Marimo Notebook Platform Actively Exploited, Exposing Cloud Credentials

Critical Pre‑Auth RCE (CVE‑2026‑39987) in Marimo Notebook Platform Actively Exploited, Exposing Cloud Credentials

What Happened – Within hours of public disclosure, threat actors began exploiting a critical pre‑authentication remote code execution flaw (CVE‑2026‑39987) in the open‑source Marimo Python notebook platform. The vulnerability allows unauthenticated access to a WebSocket‑based terminal, giving attackers a full interactive shell with the same privileges as the Marimo process. Exploitation has already resulted in rapid credential harvesting, including cloud API keys and environment secrets.

Why It Matters for TPRM –

• The flaw targets a development‑tool used across many third‑party SaaS and data‑analytics pipelines, creating a supply‑chain risk.
• Successful exploitation yields direct access to cloud credentials, enabling lateral movement into downstream services.
• Rapid weaponisation demonstrates that zero‑day style exploits can appear in widely‑adopted open‑source components, demanding continuous monitoring.

Who Is Affected – Data‑science teams, ML/AI research groups, and any organization that deploys Marimo notebooks on‑premise or exposes them to a network (e.g., fintech, health‑tech, cloud‑native SaaS providers).

Recommended Actions –

• Immediately upgrade all Marimo deployments to version 0.23.0 or later.
• Review network exposure; block inbound traffic to the /terminal/ws endpoint or restrict it to trusted IP ranges.
• Rotate any cloud credentials, API keys, or SSH keys that may have been stored in environment files or .env assets.
• Incorporate open‑source component scanning into your vendor risk program and monitor for similar pre‑auth RCE patterns.

Technical Notes – The vulnerability resides in the WebSocket endpoint /terminal/ws, which lacks authentication checks, allowing any client to spawn an interactive shell. CVE‑2026‑39987 received a CVSS 9.3 (critical). Exploitation steps observed: connection validation → simple commands (pwd, whoami) → extraction of .env files → harvesting of cloud secrets. Source: BleepingComputer