CVE-2026-39987Active Exploitation(coreweave / marimo)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 27 mentions and remains active

Immediate actions

Patch coreweave marimo systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

coreweave CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-05-07. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Patch / fix

Exploit / PoC references

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987

Weakness type (CWE)

CWE-306

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

marimo

Threat summary

Active exploitation appears in 210 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
275 mentions across 58 observed days

What's happening

Active exploitation reported across 210 signals
Exploit tool or code specified in 19 signals
PoC mentioned or linked in 25 signals
Patch or workaround mentioned in 55 signals
Technical details provided in 166 signals
Disclosure: 31 classified signals
General: 16 classified signals
Peaked 56d ago at 27 mentions (2026-04-10); latest day: 3
275 total mentions across 58 days

Affected systems

Vendors

coreweave

Products

marimo

Deep dive

Activity timeline275 mentions / 58d

Signal classification6 categories

Active Exploitation

20876.8%

Disclosure

3111.4%

General

165.9%

Patch

124.4%

Exploit

31.1%

PoC

10.4%

Referenced assets170 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-09	4	Active Exploitation1Disclosure2Patch1
2026-04-10	27	Active Exploitation26Patch1
2026-04-11	18	Active Exploitation16Disclosure2
2026-04-12	14	Active Exploitation14
2026-04-13	17	Active Exploitation15Disclosure1Patch1
2026-04-14	4	Active Exploitation3Patch1
2026-04-15	5	Active Exploitation5
2026-04-16	6	Active Exploitation6
2026-04-17	8	Active Exploitation8
2026-04-18	7	Active Exploitation6Disclosure1
2026-04-19	2	Active Exploitation1Disclosure1
2026-04-20	5	Active Exploitation1Disclosure3Patch1
2026-04-21	1	Active Exploitation1
2026-04-22	1	Active Exploitation1
2026-04-23	5	Active Exploitation4Disclosure1
2026-04-24	9	Active Exploitation5Disclosure3General1
2026-04-25	2	Active Exploitation2
2026-04-28	2	Active Exploitation2
2026-04-29	3	Active Exploitation1General1Patch1
2026-04-30	3	Disclosure1General2
2026-05-13	1	Patch1
2026-05-15	3	Active Exploitation3
2026-05-17	1	Disclosure1
2026-05-18	3	Disclosure3
2026-05-25	1	Patch1
2026-05-26	2	Active Exploitation2
2026-05-28	2	Active Exploitation2
2026-05-29	19	Active Exploitation15Disclosure3General1
2026-05-30	15	Active Exploitation13Disclosure1General1
2026-05-31	6	Active Exploitation6
2026-06-01	6	Active Exploitation5General1
2026-06-02	3	Active Exploitation3
2026-06-03	1	Active Exploitation1
2026-06-04	17	Active Exploitation15Disclosure1General1
2026-06-05	2	Active Exploitation1General1
2026-06-06	1	Active Exploitation1
2026-06-08	2	Active Exploitation2
2026-06-09	3	Active Exploitation3
2026-06-12	3	Active Exploitation1Disclosure1Patch1
2026-06-16	3	Active Exploitation1Exploit1Patch1
2026-06-18	5	Active Exploitation2Disclosure2General1
2026-06-22	1	General1
2026-07-09	1	Active Exploitation1
2026-07-19	2	Disclosure1Patch1
2026-08-02	1	Active Exploitation1
2026-08-16	1	General1
2026-08-29	1	Active Exploitation1
2026-09-11	2	Active Exploitation1General1
2026-09-12	4	Disclosure1Exploit1General2
2026-09-13	1	Disclosure1
2026-09-14	1	Active Exploitation1
2026-09-15	8	Active Exploitation5Disclosure1General1Patch1
2026-09-16	1	Active Exploitation1
2026-09-17	3	Active Exploitation2Exploit1
2026-09-18	1	PoC1
2026-09-24	1	Active Exploitation1

Full discourse20 posts

Rishi@rxerium179d
Active Exploitation
🚨 Pre-Auth RCE vuln tagged as CVE-2026-39987 (CVSS 9.3) seeing active exploitation in the wild as reported by Vulncheck and Bleeping Computer. Passively scan infrastructure to find potentially vulnerable instances: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-39987.yaml An unauthenticated attacker can obtain a full interactive root shell on the server via a single WebSocket connection. No user interaction or authentication token is required, even when authentication is enabled on the marimo instance. Patched version is 0.23.0 as per the advisory: https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
Post summary
The post confirms that CVE-2026-39987, a pre‑authentication RCE via WebSocket, is actively being exploited in the wild, offers a scanning resource, and references the patch version and advisory.
878239526236.9K
3.8K followersView on X
NullSecurityX@NullSecurityX168d
Disclosure
A pre-auth attacker can open a single WebSocket connection and obtain a fully interactive root shell. Due to missing auth checks in the handler, marimo exposes RCE without tokens or user interaction, even when auth is enabled. CVE-2026-39987 https://t.co/OVdAYcTCmn
Post summary
The post reveals a pre‑authentication WebSocket‑based RCE in marimo that yields a root shell, but does not mention a PoC link, exploit code, or active attacks, and no patch or mitigation is discussed.
231025512417.9K
12.3K followersView on X
The Hacker News@TheHackersNews132d
Active Exploitation
⚠️ Attackers used an LLM agent for post-exploitation after breaching a public Marimo notebook via CVE-2026-39987, a pre-auth RCE flaw affecting versions ≤0.20.4. The intrusion stole cloud credentials, retrieved an SSH key from AWS Secrets Manager, and exfiltrated a PostgreSQL database via eight SSH sessions in under two minutes. Full report: https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html
Post summary
Attackers leveraged CVE‑2026‑39987, a pre‑auth RCE in Marimo notebooks, to exfiltrate credentials and database data using an LLM agent, demonstrating active exploitation in the wild.
6210691011.7K
1.9M followersView on X
The Hacker News@TheHackersNews181d
Active Exploitation
⚠️ Marimo CVE-2026-39987 gave attackers a full shell with no authentication. A missing check in /terminal/ws allowed remote code execution on exposed systems. Exploitation began within 9 hours of disclosure—no PoC needed. 🔗 Details here → https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html
Post summary
CVE-2026-39987 in Marimo enables unauthenticated RCE, with exploitation reported within hours of disclosure and no PoC or patch details provided.
2153481310.9K
1.7M followersView on X
秋风@q1uf3ng183d
Patch
CVE+++ CVE-2026-39987 @marimo_io Super fast response, great to work with. https://marimo-team.notion.site/Security-Release-CWE-306-Remote-Code-Execution-via-Terminal-WebSocket-Authentication-Bypass-33cdbf71a058806fa9b5e1fc5d72fb25 https://t.co/PtReG7gcv1
Post summary
The tweet references CVE-2026-39987 and links to a vendor security release that provides patch details and technical information, but no PoC, exploit code, or active exploitation is mentioned.
24147811.7K
2.2K followersView on X
CISA Cyber@CISACyber168d
Active Exploitation
🛡️ We added Marimo remote code execution vulnerability CVE-2026-39987 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q for more information. https://t.co/QZuPkWv5RE
Post summary
The tweet announces that CVE-2026-39987, a remote code execution flaw in Marimo, has been added to the Known Exploited Vulnerabilities Catalog, indicating it is being actively exploited, but it offers minimal technical or mitigation details.
61423037.1K
299.5K followersView on X
Dark Web Informer@DarkWebInformer132d
Disclosure
‼️Root in One Request: Pre-Auth RCE in Marimo (CVE-2026-39987) https://darkwebinformer.com/root-in-one-request-pre-auth-rce-in-marimo-cve-2026-39987/
Post summary
A new pre‑authenticated remote code execution vulnerability (CVE‑2026‑39987) in Marimo has been disclosed, with basic type details but no exploit code, patch, or evidence of active exploitation.
0603475.6K
223.7K followersView on X
yousukezan@yousukezan181d
Active Exploitation
オープンソースのPythonノート環境Marimoに致命的脆弱性が発覚し、公表からわずか10時間以内に実際の攻撃が確認された。認証不要で遠隔操作が可能な深刻な問題である。問題はCVE-2026-39987（CVSS 9.3）で、0.20.4までの全バージョンに影響する。原因は/terminal/wsのWebSocketエンドポイントに認証検証がなく、攻撃者が資格情報なしで接続しフル機能のシェルを取得できる点にある。本来必要なvalidate_auth()が呼ばれず、動作モード確認のみで接続が許可されていた。Sysdigの観測では公開後9時間41分で攻撃が始まり、攻撃者は即座に.envファイルやSSH鍵の探索を実施した。活動は人手による操作とみられ、複数回接続しながら情報収集を進めていた。修正は0.23.0で提供済みだが、公開直後から悪用される現実が改めて示された。 https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html
Post summary
CVE-2026-39987 in Marimo caused unauthenticated remote code execution actively exploited within 10 hours of disclosure, and a patch (v0.23.0) is available for the vulnerability.
01301783.2K
14.3K followersView on X
OrcaRouter 🐳@OrcaRouter112d
Active Exploitation
That was EchoLeak. And the 2026 leak wall is worse: • Chat & Ask AI — 300M private messages from 25M users, wide open (Firebase misconfig) • Sears — 3.7M AI chat logs + call recordings exposed • marimo (CVE-2026-39987) — an AI agent went from one CVE to dumping an entire internal database in under 2 minutes
Post summary
The tweet reports that the marimo CVE‑2026‑39987 was used in the wild, enabling an AI agent to extract a complete internal database within two minutes.
1201975.3K
11.9K followersView on X
Florian Hansemann@CyberWarship144d
Disclosure
''Resecurity | Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987)'' #infosec #pentest #redteam #blueteam https://www.resecurity.com/blog/article/marimo-pre-auth-rce-via-unauthenticated-websocket-terminal-cve-2026-39987
Post summary
A blog post announces a new pre‑authentication RCE vulnerability in Marimo accessed through an unauthenticated WebSocket terminal, detailing the exploit vector but not yet reporting any active exploitation or available patch.
1401473.5K
88.5K followersView on X
Gray Hats@the_yellow_fall179d
Active Exploitation
Unauthenticated RCE in marimo (CVE-2026-39987) exploited in the wild in record time. Attackers gained root access in under 10 hours. Patch to v0.23.0 now! #marimo #PythonSecurity #RCE #InfoSec #CVE202639987 #ZeroDay https://securityonline.info/marimo-terminal-rce-cve-2026-39987-exploited-in-wild/ https://t.co/RhZGDcSswI
Post summary
CVE‑2026‑39987 was actively exploited, granting attackers root in under 10 hours, and a patch (v0.23.0) is now available.
240172995
12.3K followersView on X
Gray Hats@the_yellow_fall130d
Active Exploitation
Analyze the Marimo CVE-2026-39987 exploit. Learn how an autonomous AI agent weaponized this flaw to exfiltrate internal database credentials. #Marimo #CVE202639987 #AIAgent #Cyberattack #Sysdig #ThreatIntel https://meterpreter.org/marimo-cve-2026-39987-exploit/ https://t.co/ddrR3nWuL0
Post summary
The post claims that CVE‑2026‑39987 was weaponized by an autonomous AI agent to exfiltrate database credentials, providing a link that likely hosts exploit code, indicating active exploitation in the wild.
0401161.0K
12.5K followersView on X
Vivek | Cybersecurity@VivekIntel132d
General
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html?m=1
Post summary
The tweet references an article about attackers using an LLM agent after exploiting Marimo CVE-2026-39987, but provides no concrete technical, PoC, exploit, or mitigation details.
1101051.1K
17.5K followersView on X
elhacker.NET@elhackernet173d
Active Exploitation
Atacantes aprovechan CVE-2026-39987 para difundir puerta trasera basada en blockchain mediante Hugging Face https://blog.elhacker.net/2026/04/atacantes-aprovechan-cve-2026-39987.html
Post summary
Attackers are actively exploiting CVE-2026-39987 to deploy a blockchain‑based backdoor via Hugging Face, as reported in the headline.
0401211.8K
140.9K followersView on X
Nicolas Krassas@Dinosn181d
Active Exploitation
Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html
Post summary
The article reports that the Marimo RCE vulnerability (CVE‑2026‑39987) was actively exploited within ten hours of its disclosure, but it does not provide a PoC, patch information, or false‑positive clarification.
030921.8K
157.5K followersView on X
Nicolas Krassas@Dinosn132d
Active Exploitation
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html
Post summary
Attackers reportedly used an LLM agent for post‑exploitation after exploiting Marimo CVE‑2026‑39987, indicating real‑world exploitation of the vulnerability.
020831.5K
158.6K followersView on X
Nicolas Krassas@Dinosn171d
Disclosure
Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987) https://www.resecurity.com/blog/article/marimo-pre-auth-rce-via-unauthenticated-websocket-terminal-cve-2026-39987
Post summary
A blog article discloses a pre‑authentication remote code execution flaw (CVE‑2026‑39987) in Marimo’s WebSocket terminal, but offers no evidence of active exploitation, patch, or PoC code in the text itself.
030801.7K
158.1K followersView on X
White Rabbitx 🏴‍☠️@TheRabbitPy131d
Active Exploitation
Attackers exploited a Marimo vulnerability (CVE-2026-39987) to get initial access. Then they deployed an LLM agent to do post-exploitation. Let that sink in: An AI agent is now poking through compromised networks, making decisions, escalating privileges … autonomously. The attack surface just gained a brain. We spent years teaching LLMs to help developers write secure code. Attackers taught theirs to break in instead. Welcome to the new arms race 🤝
Post summary
Attackers used CVE-2026-39987 for initial access and deployed an autonomous LLM agent for post‑exploitation, indicating the CVE is actively exploited in the wild.
31060322
1.8K followersView on X
ExploitGrid@exploitgrid1d
ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2025-57819 (CVSS: 10) FreePBX CVE-2026-105134 (CVSS: 10) Ahsay CVE-2026-40281 (CVSS: 10) gotenberg CVE-2024-40453 (CVSS: 9.8) CVE-2026-39987 (CVSS: 9.3) marimo-team ..🧵👇
11061289
370 followersView on X
Rectifyq@_rectifyq130d
Active Exploitation
[Threat][MY]🟡CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace Type: Broad-based Date: 15 Apr 2026 Refer: https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface #rectifyq #cti #threatintel #threatintelligence #malaysia #infosec
Post summary
The post announces that CVE-2026-39987 has been actively exploited by attackers who weaponized the marimo plugin to launch a blockchain botnet through HuggingFace, indicating ongoing real‑world use of the vulnerability.
14040736
820 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	coreweave	marimo	-	python	-

Explore more

Back to dashboard coreweave CVEs marimo vulnerabilities

What researchers are saying

CVE-2026-39987

Rishi[verified]@rxeriumActive Exploitation

The post confirms that CVE-2026-39987, a pre‑authentication RCE via WebSocket, is actively being exploited in the wild, offers a scanning resource, and references the patch version and advisory.

NullSecurityX[verified]@NullSecurityXDisclosure

The post reveals a pre‑authentication WebSocket‑based RCE in marimo that yields a root shell, but does not mention a PoC link, exploit code, or active attacks, and no patch or mitigation is discussed.

秋风[verified]@q1uf3ngPatch

The tweet references CVE-2026-39987 and links to a vendor security release that provides patch details and technical information, but no PoC, exploit code, or active exploitation is mentioned.

yousukezan[verified]@yousukezanActive Exploitation

CVE-2026-39987 in Marimo caused unauthenticated remote code execution actively exploited within 10 hours of disclosure, and a patch (v0.23.0) is available for the vulnerability.

OrcaRouter 🐳[verified]@OrcaRouterActive Exploitation

The tweet reports that the marimo CVE‑2026‑39987 was used in the wild, enabling an AI agent to extract a complete internal database within two minutes.

Vivek | Cybersecurity[verified]@VivekIntelGeneral

The tweet references an article about attackers using an LLM agent after exploiting Marimo CVE-2026-39987, but provides no concrete technical, PoC, exploit, or mitigation details.

Nicolas Krassas[verified]@DinosnActive Exploitation

The article reports that the Marimo RCE vulnerability (CVE‑2026‑39987) was actively exploited within ten hours of its disclosure, but it does not provide a PoC, patch information, or false‑positive clarification.

Nicolas Krassas[verified]@DinosnActive Exploitation

Attackers reportedly used an LLM agent for post‑exploitation after exploiting Marimo CVE‑2026‑39987, indicating real‑world exploitation of the vulnerability.