Exploit for Missing Authentication for Critical Function in Coreweave Marimo

githubexploit · 2026-08-10

Description

PoC WebSocket client for CVE-2026-39987 missing authentication in Coreweave Marimo for authorized security testing.

Affected Coreweave Marimo versions

Coreweave Marimo< 0.23.0

All known vulnerabilities by product

CVSS 9.8 for CVE-2026-39987

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

Working code

96%confidence this exploit runs

Based on 2 file(s) in the source

Exploit Details

Modified:2026-08-10 02:08

Last Seen:2026-08-10 02:20

Reporter:MADA0L

Written in:Python

Last commit:2026-08-10

Tags

missing authenticationcritical functioncoreweave marimowebsocket pocauthorized security testingvulnerability 2026 39987

Other exploits for CVE-2026-39987

cve-analysis-lab

2026-08-14 harshal561GITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-08-12 matesz44GITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-08-07 alreadyClosedGITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-08-02 gbuyssensGITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-08-02 jasonbernierGITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-08-02 vanhariGITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-06-02 jenniferreire26GITHUB

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

2026-05-16 0xdeadrootGITHUB

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=64947BF2-3A8C-5A49-A8CB-F981C4E95B97
# CVE-2026-39987-Poc
Proof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.