Skip to content
Pre-Auth RCE Vulnerability in Marimo Exposed

Pre-Auth RCE Vulnerability in Marimo Exposed

First seen 16 Oct 2026, 13:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 13:39 UTC
  • •CVE-2026-39987 allows unauthenticated remote code execution on Marimo.
  • •Active exploitation confirmed within hours of the vulnerability's disclosure.
  • •Upgrade to version 0.23.0 or later to mitigate the risk.

Marimo, a Python notebook platform, has a pre-authorization remote code execution vulnerability (CVE-2026-39987) affecting all versions prior to 0.23.0. The flaw allows unauthenticated attackers to gain shell access via the /terminal/ws WebSocket endpoint, executing arbitrary commands with root privileges in default Docker deployments. Active exploitation was confirmed within hours of the advisory's publication, with credential theft operations observed. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog due to its severity and active exploitation. Users are urged to upgrade to version 0.23.0 or later and restrict network access to the Marimo server. Monitoring for unauthorized WebSocket connections is also recommended.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-04-09
CVE-2026-39987 published
Marimo disclosed a critical pre-auth RCE vulnerability affecting all versions prior to 0.23.0.
Knoxsystems
2026-04-23
CISA adds CVE-2026-39987 to KEV catalog
CISA confirmed active exploitation of the vulnerability in the wild, listing it in the KEV catalog.
Knoxsystems
2026-10-16
Active exploitation observed
Exploitation of the vulnerability was confirmed by the Sysdig Threat Research Team within hours of the advisory's publication.
Knoxsystems

More articles in this cluster (2)

Following this threat?

Track CVE-2026-39987 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

Which versions are affected?
All versions of Marimo prior to 0.23.0 are affected by this vulnerability.
Is this vulnerability actively exploited?
Yes, active exploitation has been confirmed within hours of the vulnerability's disclosure.
What actions should be taken immediately?
Upgrade to Marimo version 0.23.0 or later and restrict network access to the server.