Sploitus

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987

githubexploit · 2026-08-02

Exploit Code

README45 lines
## https://sploitus.com/exploit?id=FCE4386F-0EEF-54FF-9056-202822791688
# CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypass (poc)

![Visitors](https://api.visitorbadge.io/api/visitors?path=https%3A%2F%2Fgithub.com%2Fvanhari%2FCVE-2026-39987&label=VISITORS&countColor=%23263759)

## Overview

This repository contains **CVE-2026-39987** affecting **marimo** versions before **0.23.0**.

The vulnerability exists in the terminal WebSocket endpoint, where insufficient authentication enforcement may allow an unauthenticated remote user to access terminal functionality under certain deployment conditions.

### This was used in a CTF so the code will not work out of the box and needs tweaking

## Affected Versions

| Affected | Fixed  |
| -------- | ------ |
| < 0.23.0 | 0.23.0 |

## Impact

An attacker who can reach the affected marimo service may be able to interact with the terminal endpoint without proper authorization.

Potential impact includes:

* Unauthorized command execution in the context of the marimo process
* Exposure of files and data accessible to the service account
* Possible compromise of connected resources depending on deployment permissions

## Installation

### OSX/Linux
```bash
git clone https://github.com/vanhari/CVE-2026-39987.git
cd CVE-2026-39987
```

## Usage
```python
python3 exp.py
```

![Usage](/assets/usage.png)

## Disclaimer This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by the tool.