Human Attacker Hits Machine-Speed Exploitation of Marimo RCE
Human Attacker Hits Machine-Speed Exploitation of Marimo RCE 🚀
A human attacker has moved from a vulnerable Marimo notebook to an SSH bastion host in just eight seconds using a toolkit built by hand, achieving a speed typically associated with AI-driven attacks. In a technical write-up published on September 11, Sysdig’s Threat Research Team revealed that the operator exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the Marimo notebook platform, showing no signs of utilizing a large language model (LLM) at any stage.
CVE-2026-39987 affects Marimo versions up to and including 0.20.4 and is fixed in version 0.23.0. The flaw exists in the terminal WebSocket endpoint, which bypassed the authentication check applied to the platform’s other WebSocket endpoints, allowing any client that opened a connection to gain an interactive shell as the Marimo process user without any credentials.
Sysdig emphasized the significance of this because Marimo notebooks typically run alongside machine learning pipelines, on hosts that have GPU access, large datasets, and credentials for AWS, GCP, and model providers. A compromised notebook can serve as a gateway to the victim’s cloud account. The operator harvested cloud credentials from two surfaces on the host: the process environment and the application’s Redis backend, replaying them against the AWS account. One of these attempts returned an SSH private key from AWS Secrets Manager, which was used to authenticate to an internet-reachable bastion host.
However, the eight seconds was just a fraction of the entire attack. Sysdig reported that the operator spent approximately four hours building and debugging the Python toolkit in earlier sessions, storing eight scripts on the host so that a later reconnection could execute the finished chain from a single command. Over a nine-hour session, the operator logged more than 850 interactive commands without utilizing any recognizable public offensive tooling. Sysdig had implemented a directive in the vulnerable container to detect LLM agents, instructing any model that read a specific file to echo a hidden marker into its output. Every AI-driven operator profiled against this flaw echoed it, but this human operator inspected the same file twice without echoing it. This prompt injection trap, which reliably caught AI agents, did not catch a human, and Sysdig referred to the result as its clearest non-LLM signature to date.
Key Takeaways
Sysdig concluded that detection methods cannot rely solely on the fingerprints of one type of attacker. An LLM-generated command stream and a hand-typed one may appear completely different but can lead to the same Secrets Manager call, SSH key handoff, and bastion connection. Sysdig’s recommendations include:
- Updating to version 0.23.0
- Placing the terminal endpoint behind authentication or disabling it
- Scoping Secrets Manager permissions so that a notebook’s credentials cannot access a bastion key
- Rotating anything exposed on a reachable instance.
Additionally, CVE-2026-39987 has been listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog for months, with a federal remediation deadline set for May 7, 2026.