Human Attacker Hits Machine-Speed Exploitation of Marimo RCE CVE-2026-39987
Sysdig details a human operator chaining pre-auth RCE CVE-2026-39987 (CVSS 9.3) in Marimo notebooks to AWS credential theft and a bastion-host pivot in eight seconds; The Hacker News adds exploitation-within-hours-of-disclosure and two unrelated campaigns…
Sysdig's Threat Research Team documented an intrusion in which a human operator exploited CVE-2026-39987, an unauthenticated remote code execution flaw in the Marimo notebook terminal WebSocket endpoint (/terminal/ws), gaining an interactive shell with no credentials. Three outlets (Infosecurity Magazine, Cyber Security News, GBHackers) state the flaw affects Marimo versions up to 0.20.4 and was fixed in 0.23.0; The Hacker News instead describes it as affecting "all Marimo versions" and assigns it a CVSS score of 9.3, also reporting active exploitation within hours of disclosure. Within eight seconds of opening the WebSocket session, the attacker harvested AWS credentials from the host process environment and the Redis backend, used Boto3 to retrieve an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable SSH bastion host. Sysdig attributed the chain to human-operated custom tooling rather than an AI agent: the operator spent roughly four hours building a custom Python toolkit staged in /tmp, then ran over 850 interactive commands during a nine-hour session using two distinct IAM identities. Blocked EC2 Instance Connect attempts — SendSSHPublicKey calls targeting the placeholder instance i-0000000000000000 — were flagged as a high-confidence detection signal, alongside recommendations to hunt for /terminal/ws connections, SSH keys in /tmp, and port 4444 callbacks. Sysdig noted its prompt-injection honeypot caught LLM agents but not this human operator, advising defenders to focus on the shape of the attack chain rather than AI-versus-human fingerprints. The flaw is listed in CISA's KEV catalog with a May 7, 2026 federal remediation deadline. Separately, The Hacker News's report bundles two distinct disclosures not linked to the Marimo intrusion: Hunt.io's XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection, and Operation CameraSwarm, linked to a single operator, which compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.
- CVE-2026-39987: unauthenticated RCE in Marimo's /terminal/ws WebSocket endpoint; affects versions up to 0.20.4 and fixed in 0.23.0 per Infosecurity Magazine, Cyber Security News, and GBHackers; The Hacker News says it affects 'all Marimo…
- Eight seconds elapsed from initial WebSocket shell to SSH bastion-host authentication
- Attack chain: AWS credentials harvested from host process environment and Redis backend; SSH private key retrieved from AWS Secrets Manager via Boto3; authentication to an internet-facing bastion host
- Human-operated attack at machine speed: custom Python toolkit staged in /tmp after roughly four hours of development; 850+ commands over a nine-hour session; two distinct IAM identities used
- Detection signals: blocked EC2 Instance Connect SendSSHPublicKey calls to placeholder instance i-0000000000000000; hunt for /terminal/ws connections, SSH keys in /tmp, and port 4444 callbacks
- Sysdig's prompt-injection honeypot caught LLM agents but not this human operator; defenders advised to focus on attack chain shape rather than AI-vs-human fingerprints
- Flaw is in CISA's KEV catalog with a May 7, 2026 federal remediation deadline; The Hacker News reports active exploitation within hours of disclosure
- Separate items reported only by The Hacker News: Hunt.io disclosed an XMRig campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection; Operation CameraSwarm, linked to a single operator,…
Coverage timelineoldest first · each row is one article
- · 1d agoHuman Attacker Hits Machine-Speed Exploitation of Marimo RCE
Infosecurity Magazine· 60
Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.
- · 12h agoHackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds
Cyber Security News· 65
Attackers exploited pre-auth RCE CVE-2026-39987 in Marimo notebooks to steal AWS credentials and SSH into a bastion host in eight seconds.
- · 11h agoMarimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
GBHackers· 72
Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.
- · 9h agoHuman Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
The Hacker News· 70
Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33044 +1 in the same advisory: …33045 | Authentication Bypass in Dahua IP Camera Firmware Dahua IP cameras and related products contain an authentication bypass flaw (CWE-287, Improper Authentication) that is triggered when the client supplies the NetKeyboard type argument during the authentication process, allowing the device to treat the session as authenticated without valid credentials. An unauthenticated remote attacker who can reach the camera's network interface can exploit this to gain unauthorized access to the device's management functions. Successful exploitation can expose camera video streams and device configuration and can serve as a foothold into the surrounding surveillance or corporate network. Any organization running affected Dahua IP camera firmware, particularly cameras exposed to the internet, is potentially affected. The flaw is confirmed to be exploited in the wild: it was added to the CISA KEV on 2024-08-21, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile), although no public PoC is known. Do: Apply the mitigations or patched firmware specified in Dahua's security advisory for CVE-2021-33044; if mitigations are unavailable, discontinue use of the product as CISA's required action directs. Inventory internet-facing Dahua cameras and related devices, restrict their login interfaces from direct internet exposure, and review authentication logs for signs of prior exploitation. Ransomware use is listed as unknown, so treat any compromised camera as a potential network foothold and rotate any credentials used on the device. | 9.8 | 100% | KEV PoC ×2 |
| massplausibly millions of installed Dahua cameras worldwide, with likely >100,000 internet-exposed Dahua devices | |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook Marimo, a reactive Python notebook, contains an unauthenticated remote code execution flaw (CVE-2026-39987, CWE-306; CVSS 4.0: 9.3 Critical) because its terminal WebSocket endpoint /terminal/ws skips authentication entirely. Unlike other WebSocket endpoints such as /ws, which call validate_auth(), /terminal/ws only checks the running mode and platform support before accepting connections, so any unauthenticated attacker who can reach the server can obtain a full PTY shell and execute arbitrary system commands on the host. All marimo deployments running versions prior to 0.23.0 are affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-04-23, public PoCs exist, and reporting shows it was exploited within roughly 10 hours of disclosure, with observed post-exploitation activity involving LLM agents. EPSS assigns a 98.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade marimo to 0.23.0 or later; until patched, restrict access to the /terminal/ws WebSocket endpoint by binding the notebook to localhost, a VPN, or an authenticating reverse proxy. Identify whether any marimo instances are internet-exposed and review logs for connections to /terminal/ws and unexpected shell or process spawns, given reports of LLM-agent-driven post-exploitation on compromised instances. As a KEV entry (added 2026-04-23), this requires federal agencies to apply the vendor fix or mitigations per BOD 22-01 timelines. | 9.3 | 99% | KEV PoC ×4 |
| moderatelikely tens of thousands of users, with directly internet-exposed marimo servers plausibly in the low thousands |