Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.
Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.
- CVE-2026-39987: unauthenticated /terminal/ws WebSocket shell in marimo, fixed in 0.23.0
- AWS credential theft to Secrets Manager key retrieval to bastion SSH completed in eight seconds
- Attacker staged custom Python automation scripts in /tmp after four hours of development
- Two distinct IAM identities used; 850+ interactive commands over nine-hour intrusion
- Defenders should hunt /terminal/ws connections, keys in /tmp, and port 4444 callbacks
- CVEs
- CVE-2026-39987
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
From the original article
3 min read at gbhackers.com
A threat actor exploited a critical pre-authentication remote code execution vulnerability in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in just eight seconds, according to the Sysdig Threat Research Team. This vulnerability, tracked as CVE-2026-39987, affects marimo versions up to 0. 20.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.