Human Attacker Hits Machine-Speed Exploitation of Marimo RCE
Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.
Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.
- CVE-2026-39987 pre-auth RCE affects Marimo up to 0.20.4, fixed in 0.23.0
- Operator harvested AWS credentials from environment and Redis, pulled SSH key from Secrets Manager
- Eight-second chain after four hours of toolkit development; 850+ commands in nine hours
- Sysdig's prompt-injection trap caught LLM agents but not this human operator
- Detection should focus on attack chain shape rather than AI-vs-human fingerprints
- CVEs
- CVE-2026-39987
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
From the original article
2 min read at infosecurity-magazine.com
A human attacker exploited a Marimo RCE and reached an SSH bastion in eight seconds
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.