CVE-2026-39987 — marimo — Fixed in 0.23.0
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
Fixed versions
Choose the version for your installed product and release branch.
| Product | Fixed versions |
|---|---|
| marimo | 0.23.0 |
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Apr 23, 2026
- US federal agencies must remediate it by May 7, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
- Confirmed by sensors, not only by reports
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Nov 10, 2026 Nov 4, 2026 Nov 2, 2026 Oct 30, 2026 Oct 28, 2026 Oct 27, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| coreweave | marimo | < 0.23.0 |
Related articles
Human Operator Exploits Marimo RCE and Reaches SSH Bastion in Eight Seconds
Human attacker exploited Marimo CVE-2026-39987 via unauthenticated WebSocket, stole AWS credentials, retrieved SSH key and reached bastion in 8 seconds.
CISA Adds Three Vulnerabilities to KEV Catalog: Langflow, Tomcat and N-central Affected
CISA adds three actively exploited vulnerabilities to the KEV catalog, impacting Langflow, Apache Tomcat, and N-central. Patch immediately by August 7, 2026.
AI Agent Orchestrated via Telegram Conducts Autonomous Attacks: Over 460 Targets Hit
Unit 42 found a Telegram-controlled AI agent using DeepSeek that autonomously attacked over 460 targets, exploiting CVEs in platforms like Langflow and n8n.
This product uses the NVD API but is not endorsed or certified by the NVD.