> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Root in One Request: Pre-Auth RCE in Marimo (CVE-2026-39987) - URL: https://darkwebinformer.com/root-in-one-request-pre-auth-rce-in-marimo-cve-2026-39987/ - Published: 2026-05-29T17:37:43.000Z - Updated: 2026-05-29T17:37:43.000Z - Author: Dark Web Informer - Tags: Vulnerabilities Critical CVSS 4.0 9.3 Status Actively Exploited CISA KEV Added 2026-04-23 # Root in One Request: Pre-Auth RCE in Marimo (CVE-2026-39987) Marimo Python Notebook • CWE-306 Missing Authentication • Published 2026-04-09 ## Vulnerability Overview [CVE-2026-39987](https://nvd.nist.gov/vuln/detail/CVE-2026-39987) is a critical pre-authentication remote code execution flaw in **Marimo**, a popular open-source reactive Python notebook framework and a modern alternative to Jupyter with roughly 19.6k GitHub stars. A remote, unauthenticated attacker only has to complete a single WebSocket handshake to an exposed instance to obtain a full interactive shell as the user running the Marimo process. Carrying a **CVSS v4.0 score of 9.3**, the bug was exploited in the wild within hours of public disclosure and was added to the [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/04/23/cisa-adds-one-known-exploited-vulnerability-catalog) on April 23, 2026, with a federal remediation deadline of May 7, 2026. CVE ID CVE-2026-39987 CVSS Score 9.3 - Critical Weakness CWE-306 Affected Product Marimo Notebook Affected Versions All < 0.23.0 Attack Vector Network / Unauthenticated Exploitation In the Wild Fixed In 0.23.0 Bottom Line If you run Marimo in edit mode anywhere reachable beyond a tightly trusted network, upgrade to 0.23.0 immediately and treat any unpatched, internet-adjacent instance as an active incident risk rather than a theoretical CVE. ## Why Marimo Is a High-Value Target Marimo is used heavily in data science, ML experimentation, and internal analytics, and is frequently run in containers with network access for collaboration. As [Endor Labs noted](https://www.endorlabs.com/learn/root-in-one-request-marimos-critical-pre-auth-rce-cve-2026-39987), the product's emphasis on remote sharing and interactive editing pushes many real deployments toward browser-reachable edit servers, and those hosts commonly sit next to sensitive data: environment files, cloud credentials, databases, and internal APIs. A single unauthenticated shell on one of these boxes often means access to colocated services and production secrets on disk, so the practical blast radius extends well past the notebook process itself. ## Technical Analysis At its core this is a WebSocket authentication failure. Marimo exposes multiple WebSocket endpoints, and the primary session path runs every connection through `validate_auth()` so that only authorized clients keep a session. The integrated terminal followed a different code path: according to the [official advisory](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc), `marimo/_server/api/endpoints/terminal.py` accepted connections after only checking that the server was in edit mode and that the platform supported a PTY, skipping the authentication validation used everywhere else. One WebSocket route was protected; a parallel route that hands out a shell was not. Middleware did not close the gap. Marimo relies on Starlette's `AuthenticationMiddleware`, which can mark a connection as unauthenticated without rejecting the WebSocket upgrade outright. Real protection has to happen at the endpoint, through `validate_auth()`, a decorator, or equivalent enforcement. Because the terminal path skipped that step, an unauthenticated client could still reach `websocket.accept()` and the subsequent `pty.fork()`, landing a live shell. The full attack chain is brutally short: the attacker opens a WebSocket to `/terminal/ws` (or `wss://` behind TLS), the server accepts it with no credentials, allocates a PTY and a shell, and the attacker runs arbitrary commands as the Marimo process - commonly root in default Docker images. There is no phishing, no stolen session, and no supply-chain trick. The terminal route is only wired up when the notebook runs in edit mode, so read-only or static notebook serving does not expose the path in the same way. ## Active Exploitation in the Wild This is not theoretical. The [GitHub advisory](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc) was published on April 8, 2026, and [exploitation began in under 10 hours](https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html). The [Sysdig Threat Research Team](https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours), running honeypot nodes across multiple cloud providers, observed the first exploitation attempt within 9 hours and 41 minutes of publication, with a complete credential-theft operation executed in under three minutes. Because the advisory itself documented a working proof of concept, attackers needed no exploit development of their own. The follow-on activity has been serious. Researchers have [tracked a campaign](https://gbhackers.com/weaponized-cve-2026-39987/) that uses the flaw to deploy a NKAbuse backdoor variant hosted on Hugging Face Spaces, pairing pre-auth RCE with credential theft, lateral movement into PostgreSQL and Redis, and a blockchain-based (NKN) command-and-control channel that is hard to monitor or block. One operator alone generated 195 events over more than three hours. Indicators worth hunting for include suspicious `curl | bash` executions referencing `vsccode-modetx`, the presence of `~/.kagent` directories, unusual per-user systemd services, and outbound NKN-related traffic from developer workstations. Exposure is also easy to underestimate. Endor Labs attempted only an unauthenticated upgrade to `/terminal/ws` against a sample of 186 internet-reachable Marimo URLs and found 30 of them, about 16 percent, completing the handshake - the exact technical step an attacker takes immediately before issuing the first command. ## Detection Because the probe is a single WebSocket upgrade, the most reliable signals are behavioral. Monitor for WebSocket connections to terminal paths from unexpected clients, and alert on new interactive shells, unusual process trees, and atypical outbound traffic from notebook infrastructure. A safe, non-destructive check is to attempt an unauthenticated upgrade to `/terminal/ws` against your own instances: a patched server (0.23.0 or later) refuses the connection at the authentication layer, while a vulnerable one completes the handshake. Detection Tell Marimo 0.23.0 aligns the terminal WebSocket with the same validation used by the primary session WebSocket, so a patched server rejects the unauthenticated `/terminal/ws` upgrade instead of allocating a PTY. Assume in-the-wild abuse and hunt for post-exploitation artifacts even if you never saw the probe in your logs. ## Affected Versions & Fixes | Product | Affected | Resolution | | --------------- | ------------ | --------------------------------------------------- | | Marimo < 0.23.0 | Vulnerable | Upgrade with pip install --upgrade "marimo>=0.23.0" | | Marimo 0.23.0+ | Not affected | Terminal WebSocket now enforces authentication | One versioning note: the advisory body text originally listed Marimo 0.20.4 and earlier as affected, but the structured version range consumed by tools such as Dependabot, pip-audit, and OSV was corrected to all versions prior to 0.23.0\. Treat anything below 0.23.0 as vulnerable. ## Mitigation & Remediation Priority order, drawn from the [vendor advisory](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc) and [Endor Labs' analysis](https://www.endorlabs.com/learn/root-in-one-request-marimos-critical-pre-auth-rce-cve-2026-39987): 1. **Patch immediately.** Upgrade to Marimo 0.23.0 or newer. This is the only complete fix, because it adds the missing authentication enforcement to the terminal WebSocket endpoint. 2. **Do not expose edit mode to untrusted networks.** Place edit-mode instances behind VPNs, private subnets, authenticated proxies, and allowlists rather than the open internet. 3. **Avoid binding to 0.0.0.0.** Do not bind Marimo to all interfaces unless your network controls are explicit and verified. 4. **Harden the container and secrets.** Run as a non-root user with read-only roots and minimal capabilities where practical, keep production `.env` files off shared lab hosts, and rotate any credentials that may have been exposed. 5. **Hunt for compromise.** Review notebook hosts for the campaign indicators above, watch for unexpected shells and egress, and assume day-one exploitation given the public proof of concept. ## The Bigger Picture CVE-2026-39987 is a textbook case of asymmetric trust: users believe the server requires authentication, while one WebSocket URL quietly did not. WebSocket upgrades are easy to overlook in code review because they resemble streaming HTTP, but a long-lived, full-duplex channel needs its identity and authorization established explicitly at upgrade time. The broader lesson applies to any developer tooling with terminals, REPLs, or kernels: powerful execution features demand strict gates - strong authentication, explicit enablement, and least privilege - and a product story built on sharing and remote access must assume every WebSocket and debug feature is part of the attack surface. ## References - [Marimo GitHub Security Advisory - GHSA-2679-6mx9-h9xc](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc) - [NVD - CVE-2026-39987](https://nvd.nist.gov/vuln/detail/CVE-2026-39987) - [CISA - KEV Catalog Addition (2026-04-23)](https://www.cisa.gov/news-events/alerts/2026/04/23/cisa-adds-one-known-exploited-vulnerability-catalog) - [Endor Labs - Root in One Request: Technical Analysis](https://www.endorlabs.com/learn/root-in-one-request-marimos-critical-pre-auth-rce-cve-2026-39987) - [Sysdig TRT - From Disclosure to Exploitation in Under 10 Hours](https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours) - [The Hacker News - Exploited Within 10 Hours of Disclosure](https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html) - [GBHackers - Weaponized to Push a Blockchain Backdoor](https://gbhackers.com/weaponized-cve-2026-39987/) - [Marimo - Fix Pull Request #9098](https://github.com/marimo-team/marimo/pull/9098) - [CWE-306 - Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)