Marimo Python Notebook Pre-Auth RCE Weaponized 9 Hours After Disclosure as CISA Adds CVE to KEV Catalog
An unauthenticated WebSocket flaw in the popular Marimo notebook (CVE-2026-39987, CVSS 9.3) was weaponized within 9 hours 41 minutes of disclosure, with credential theft completed in under three minutes. CISA has since added the bug to its KEV catalog with a May 7 federal deadline.
Overview
A critical pre-authentication remote code execution flaw in Marimo, a popular open-source Python notebook used by data scientists and machine-learning practitioners, was weaponized in the wild less than ten hours after its public disclosure, illustrating how rapidly modern attackers can build working exploits from advisory text alone. The U.S. Cybersecurity and Infrastructure Security Agency has added the bug to its Known Exploited Vulnerabilities catalog, with the catalog entry recording a date-added of April 23, 2026 and a remediation due date of May 7, 2026 for Federal Civilian Executive Branch agencies.
What We Know
The vulnerability, tracked as CVE-2026-39987 with a CVSS 4.0 base score of 9.3, sits in Marimo’s /terminal/ws WebSocket endpoint, which accepts connections without invoking the project’s validate_auth() check that guards other WebSocket routes. As SecurityWeek reports, the endpoint “only checks the running mode and platform support before accepting connections, completely skipping authentication verification,” handing any unauthenticated attacker an interactive PTY shell with the privileges of the Marimo process. The NVD entry for CVE-2026-39987 confirms the same primitive and the CVSS 4.0 score of 9.3.
All Marimo releases up to and including 0.20.4 are vulnerable, and the fix shipped in version 0.23.0, SecurityWeek notes. The GitHub release tag for Marimo 0.23.0 records a publication date of April 9, 2026 — one day after the GHSA-2679-6mx9-h9xc advisory was published. BleepingComputer reports that Marimo disclosed the flaw on April 8.
Cloud security firm Sysdig, which discovered the in-the-wild exploitation through its honeypot infrastructure, observed the first attack 9 hours and 41 minutes after the advisory was made public, according to SecurityWeek. No public proof-of-concept code existed when the exploitation began; the attacker built a working exploit using only the technical details in the advisory itself.
The attacker behavior was unusually deliberate. BleepingComputer describes the operator using “methodical” hands-on tactics focused on stealing “.env credentials and SSH keys” rather than dropping persistence implants or cryptominers. SecurityWeek reports that the threat actor performed reconnaissance within two minutes of connecting and completed credential exfiltration within three minutes total, then returned roughly an hour later for a second session to revalidate access and re-pull the harvested files. CSO Online reports that the third session targeted an environment file containing AWS access keys, and quotes the “complete credential theft operation executed in under 3 minutes” finding.
Reconnaissance activity was far broader than the active exploitation. BleepingComputer reports that 125 IP addresses were observed scanning for and probing exposed Marimo instances within the first 12 hours of the bug becoming public, even as only one IP progressed to full exploitation in that initial window.
CISA Action
CISA’s Known Exploited Vulnerabilities catalog lists CVE-2026-39987 with a date-added of April 23, 2026 and a due date of May 7, 2026 — meaning Federal Civilian Executive Branch agencies bound by Binding Operational Directive 22-01 must remediate the flaw by that deadline. The catalog entry’s required-action text instructs agencies to “apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” KEV inclusion also acts as a strong signal to the broader private sector that exploitation is real and ongoing, and many enterprises align their patch SLAs to the same deadlines.
Mitigation guidance from the reporting researchers is direct: upgrade to Marimo 0.23.0, restrict access to /terminal/ws via firewall rules or an authenticated reverse proxy, and rotate any cloud keys, API tokens, or SSH credentials that may have been exposed on a previously reachable instance, per CSO Online.
What We Don’t Know
Attribution for the exploitation activity has not been established publicly. The reports describe a single human-operated session focused on quick credential theft, but the longer-term goals of the operator, whether the same actor was responsible for the broader scanning campaign, and whether stolen AWS keys have been used in downstream intrusions remain unreported. The total population of exposed Marimo instances at the time of disclosure is also unclear; the project carries roughly 20,000 GitHub stars, per BleepingComputer, but how many production deployments are reachable from the public internet has not been quantified.
It is also unknown how many enterprise users will hit the May 7 federal deadline. Marimo is widely used in research and ML pipelines, where notebook servers are frequently exposed to internal networks rather than centrally inventoried, and credential rotation across cloud accounts that may have been compromised is a separate operational lift beyond simply applying the patch.
Analysis
The Marimo incident reinforces a pattern that has hardened over the past year of disclosures: the window between advisory publication and weaponization is now measured in single-digit hours for high-severity, easily reachable bugs. An unauthenticated WebSocket endpoint that drops the caller into a shell is essentially a textbook exploitation primitive, and the advisory’s mention of the specific path was sufficient signal for an operator to build an exploit faster than most organizations can review and deploy a patch.
That compression has knock-on effects for open-source maintainers. Marimo’s response, shipping a fix the day after disclosure, is fast by industry standards, but the asymmetry between attacker tooling and defender patching cycles means even rapid maintainer turnaround leaves a meaningful exploitation window for exposed instances. The case also underscores the operational hygiene cost of running interactive notebook servers as production-adjacent infrastructure: secrets in .env files and SSH keys in default home directories continue to be a primary loot target, and any internet-reachable notebook is effectively a credential vault waiting to be opened the next time a pre-auth flaw lands.