CVE-2026-39987
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Apr 23, 2026
- US federal agencies must remediate it by May 7, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
- Confirmed by sensors, not only by reports
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Sep 16, 2026 Sep 15, 2026 Sep 14, 2026 Sep 12, 2026 Sep 11, 2026 Sep 11, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| coreweave | marimo | < 0.23.0 |
Related articles
AIAI Agent Orchestrated via Telegram Conducts Autonomous Attacks: Over 460 Targets Hit
Unit 42 found a Telegram-controlled AI agent using DeepSeek that autonomously attacked over 460 targets, exploiting CVEs in platforms like Langflow and n8n.
VulnerabilitiesCISA Adds Three Vulnerabilities to KEV Catalog: Langflow, Tomcat and N-central Affected
CISA adds three actively exploited vulnerabilities to the KEV catalog, impacting Langflow, Apache Tomcat, and N-central. Patch immediately by August 7, 2026.
VulnerabilitiesHuman Operator Exploits Marimo RCE and Reaches SSH Bastion in Eight Seconds
Human attacker exploited Marimo CVE-2026-39987 via unauthenticated WebSocket, stole AWS credentials, retrieved SSH key and reached bastion in 8 seconds.
This product uses the NVD API but is not endorsed or certified by the NVD.