Human Attacker Hits Machine-Speed Exploitation of Marimo RCE
Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.
Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.
- CVE-2026-39987 pre-auth RCE affects Marimo up to 0.20.4, fixed in 0.23.0
- Operator harvested AWS credentials from environment and Redis, pulled SSH key from Secrets Manager
- Eight-second chain after four hours of toolkit development; 850+ commands in nine hours
- Sysdig's prompt-injection trap caught LLM agents but not this human operator
- Detection should focus on attack chain shape rather than AI-vs-human fingerprints
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook Marimo, a reactive Python notebook, contains an unauthenticated remote code execution flaw (CVE-2026-39987, CWE-306; CVSS 4.0: 9.3 Critical) because its terminal WebSocket endpoint /terminal/ws skips authentication entirely. Unlike other WebSocket endpoints such as /ws, which call validate_auth(), /terminal/ws only checks the running mode and platform support before accepting connections, so any unauthenticated attacker who can reach the server can obtain a full PTY shell and execute arbitrary system commands on the host. All marimo deployments running versions prior to 0.23.0 are affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-04-23, public PoCs exist, and reporting shows it was exploited within roughly 10 hours of disclosure, with observed post-exploitation activity involving LLM agents. EPSS assigns a 98.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade marimo to 0.23.0 or later; until patched, restrict access to the /terminal/ws WebSocket endpoint by binding the notebook to localhost, a VPN, or an authenticating reverse proxy. Identify whether any marimo instances are internet-exposed and review logs for connections to /terminal/ws and unexpected shell or process spawns, given reports of LLM-agent-driven post-exploitation on compromised instances. As a KEV entry (added 2026-04-23), this requires federal agencies to apply the vendor fix or mitigations per BOD 22-01 timelines. | 9.3 | 99% | KEV PoC ×4 |
| moderatelikely tens of thousands of users, with directly internet-exposed marimo servers plausibly in the low thousands |
Full article484 words · extracted from infosecurity-magazine.com · click to collapse
A human attacker has moved from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a toolkit built by hand, hitting a speed usually associated with AI-driven attacks.
In a technical write-up published on September 11, Sysdig's Threat Research Team said the operator exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the Marimo notebook platform, and showed no sign of using a large language model (LLM) at any stage.
A Human at Machine Speed
CVE-2026-39987 affects Marimo up to and including 0.20.4 and is fixed in 0.23.0. The flaw is in the terminal WebSocket endpoint, which skipped the authentication check applied to the platform's other WebSocket endpoints, so any client that opened a connection to it got an interactive shell as the Marimo process user with no credentials.
Sysdig said that matters because Marimo notebooks usually run alongside machine learning pipelines, on hosts holding GPU access, large datasets and credentials for AWS, GCP and model providers. A compromised notebook, it said, is the door to the victim's cloud account.
The operator harvested cloud credentials from two surfaces on the host, the process environment and the application's Redis backend, and replayed them against the AWS account. One returned an SSH private key from AWS Secrets Manager, used to authenticate to an internet-reachable bastion host.
The eight seconds was not the whole attack. Sysdig said the operator spent about four hours building and debugging the Python toolkit in earlier sessions, storing eight scripts on the host so a later reconnection fired the finished chain from one command.
Over a nine-hour session it logged more than 850 interactive commands and no recognizable public offensive tooling.
The Attacker Bypassed a Trap Built for AI
Sysdig had planted a directive in the vulnerable container to catch LLM agents, telling any model that read a particular file to echo a hidden marker into its output. Every AI-driven operator profiled against this flaw echoed it.
This operator inspected the same file twice and never echoed it. That prompt injection trap, which reliably caught AI agents, did not catch a human, and Sysdig called the result its clearest non-LLM signature to date.
The takeaway, Sysdig said, is that detection cannot lean on the fingerprints of one attacker type. An LLM-generated command stream and a hand-typed one look completely different but end at the same Secrets Manager call, SSH key handoff and bastion connection. This means the priority is the shape of the chain, not the typing.
Sysdig's recommendations include updating to 0.23.0, putting the terminal endpoint behind authentication or disabling it, scoping Secrets Manager permissions so a notebook's credentials cannot read a bastion key, and rotating anything exposed on a reachable instance.
CVE-2026-39987 has been on CISA's Known Exploited Vulnerabilities (KEV) catalog for months, with a federal remediation deadline of May 7, 2026.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/human-attacker-machine-speed/