Vulnerabilities · 7h ago

Marimo Terminal Flaw Reached a Bastion in Seconds

Sysdig said a human operator used CVE-2026-39987 in Marimo notebook and reached an SSH bastion in eight seconds after opening a vulnerable notebook. The flaw was in the terminal WebSocket endpoint, which skipped the login check used by Marimo’s other endpoints and handed the client an interactive shell as the Marimo process user with no credentials.

From that shell, the operator pulled cloud credentials from the process environment and the app’s Redis-backed state, then replayed them against AWS; one lookup returned an SSH private key from AWS Secrets Manager and opened the path to the bastion. In other words, the exposed terminal was enough to turn a notebook session into cloud-account access and downstream SSH reach.

The risk sits wherever notebooks live beside cloud secrets, model-provider keys, or bastions. If a Marimo deployment can see those assets, the blast radius is not the notebook itself but the environment it can already reach, and a patch only closes the hole if the terminal endpoint and surrounding trust boundaries are treated as part of the exposure.

CVE-2026-39987

NVD KEV

Known exploited · CISA KEV

EPSS 99% (100th percentile).

CISA federal remediation date May 7 · date passed

Timeline

Sep 14 Reported by Infosecurity Magazine
May 7 CISA federal deadline for CVE-2026-39987 passed
Apr 23 CVE-2026-39987 added to CISA KEV

Sources

1 source covering this story

Infosecurity Magazine Sep 14
Human Attacker Hits Machine-Speed Exploitation of Marimo RCE
A human attacker exploited a Marimo RCE and reached an SSH bastion in eight seconds

Entities

CVE-2026-39987

Part of the PlainSec briefing for 2026-09-14

Editions

Briefing for 2026-09-14

Vulnerabilities · 7h agoMarimo Terminal Flaw Reached a Bastion in SecondsSysdig said a human operator used CVE-2026-39987 in Marimo notebook and reached an SSH bastion in eight seconds after opening a vulnerable notebook. The flaw was in the terminal WebSocket endpoint, which skipped the login check used by Marimo’s other endpoints and handed the client an interactive shell as the Marimo process user with no credentials.From that shell, the operator pulled cloud credentials from the process environment and the app’s Redis-backed state, then replayed them against AWS; one lookup returned an SSH private key from AWS Secrets Manager and opened the path to the bastion. In other words, the exposed terminal was enough to turn a notebook session into cloud-account access and downstream SSH reach.The risk sits wherever notebooks live beside cloud secrets, model-provider keys, or bastions. If a Marimo deployment can see those assets, the blast radius is not the notebook itself but the environment it can already reach, and a patch only closes the hole if the terminal endpoint and surrounding trust boundaries are treated as part of the exposure.