CVE-2026-39987

Name of the Vulnerable Software and Affected Versions Marimo versions prior to 0.23.0

Description Marimo contains a pre-authentication remote code execution (RCE) flaw. The terminal WebSocket endpoint /terminal/ws fails to perform authentication validation, whereas other endpoints like /ws correctly utilize the validate auth() function. This omission allows an unauthenticated remote attacker to establish a connection, obtain a full PTY shell, and execute arbitrary system commands with the privileges of the notebook owner, which may be root in default Docker deployments.

Real-world incidents have demonstrated the severity of this issue, including a documented case where an LLM-driven agent autonomously orchestrated a post-exploitation chain. The agent harvested cloud credentials, retrieved SSH keys from AWS Secrets Manager, and exfiltrated an entire PostgreSQL database in under one hour. Other observed attacks involved the deployment of the NKAbuse Go backdoor and lateral movement to Redis and PostgreSQL instances.

Recommendations Update Marimo to version 0.23.0 or later. As a temporary mitigation, restrict network access to the /terminal/ws endpoint or disable the terminal feature entirely. Place Marimo notebook servers behind a VPN or Zero Trust Network Access (ZTNA) gateway to block public WAN access to the server port. Enable mandatory authentication using the --token or --password flags upon startup.