CVE-2026-39987: Marimo Remote Code Execution Vulnerability
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Overview
Marimo, a reactive Python notebook platform, contains a missing authentication check on its terminal WebSocket endpoint that allows any unauthenticated network attacker to obtain a full interactive shell on the server. The flaw affects all versions prior to 0.23.0. Exploitation requires only a single WebSocket connection, no credentials or tokens, and yields arbitrary command execution with the privileges of the marimo process, which runs as root in default Docker deployments. Active exploitation was observed in the wild within hours of the advisory's publication.
Vulnerability details
The /terminal/ws WebSocket endpoint in Marimo's server skips the validate_auth() call that other endpoints, such as /ws, correctly perform before accepting connections. Marimo's authentication middleware marks unauthenticated connections as UnauthenticatedUser but does not actively reject them; actual enforcement depends on endpoint-level decorators or explicit validate_auth() calls. Because /terminal/ws has neither, any inbound WebSocket connection is accepted regardless of whether authentication is configured on the instance. Once accepted, the server calls pty.fork() and hands the caller a full pseudo-terminal shell.
An attacker with network access to the marimo server connects to ws://TARGET:2718/terminal/ws without supplying any credentials or tokens. The server accepts the connection, forks a PTY child process, and the attacker receives an interactive shell running with the privileges of the marimo process. In default Docker deployments this means root-level access. From that position the attacker can read environment variables, steal API keys and cloud credentials stored in the notebook environment, and move laterally to connected infrastructure. The Sysdig Threat Research Team observed a complete credential theft operation executed in under three minutes following initial access, with exploitation occurring less than ten hours after the advisory was published.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor WebSocket upgrade requests to the path
/terminal/wsfrom any source that has not previously authenticated to the marimo instance. A connection to this endpoint from an external or unexpected IP with no prior authenticated session is a strong indicator of exploitation.
Remediation
Additional hardening
- Upgrade marimo to version 0.23.0 or later, which adds authentication validation to the
/terminal/wsendpoint consistent with thevalidate_auth()pattern used by other WebSocket endpoints. - Restrict network access to the marimo server port (default 2718) to trusted hosts only using firewall rules or security group policies. The marimo server should never be exposed directly to the internet, particularly when running in EDIT mode.
- Run marimo as a non-root user rather than in default Docker configurations that grant root privileges. Reducing the process privilege level limits the impact of a successful shell takeover to the permissions of that user account.
- If the terminal feature is not required, block access to the
/terminal/wspath at the reverse proxy or load balancer layer as a compensating control until the patch can be applied.
Key dates
References
- https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
- https://nvd.nist.gov/vuln/detail/CVE-2026-39987
- https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours
- https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a
- https://github.com/marimo-team/marimo/pull/9098
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987
Frequently asked questions
Does CVE-2026-39987 affect my FedRAMP authorization?
If Marimo runs inside your authorization boundary, CVE-2026-39987 affects your Federal Risk and Authorization Management Program (FedRAMP) authorization directly. CISA's Known Exploited Vulnerabilities (KEV) catalog includes this vulnerability, and its remediation deadline of May 7, 2026 has already passed. An unpatched KEV inside your boundary is an assessor finding; an overdue one is visible to both your assessor and your sponsoring agency. At this point, you remediate now or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-39987?
Knox does not patch your software. Remediating Marimo is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that support documentation of the fix for your next assessment. The remediation work is yours to carry out; maintaining a defensible compliance posture while you carry it out is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. For a vulnerability like CVE-2026-39987, that means exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into where the boundary stands.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-39987's remediation deadline of May 7, 2026 has passed. What happens now?
If CVE-2026-39987 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
