Human Attacker Achieves Machine-Speed Exploitation of Marimo RCE
A human threat actor exploited a Marimo RCE vulnerability and gained access to an SSH bastion host in just eight seconds, demonstrating sophisticated, rapid exploitation tactics.
A human attacker has achieved a level of speed in exploiting a Marimo notebook vulnerability that typically characterizes AI-driven attacks, compromising an SSH bastion host in a mere eight seconds. The incident, detailed by Sysdig's Threat Research Team, involved the exploitation of CVE-2026-39987, a critical pre-authentication remote code execution (RCE) flaw in the Marimo platform.
The vulnerability, affecting Marimo versions up to 0.20.4 and patched in 0.23.0, resides in the terminal WebSocket endpoint. Unlike other WebSocket endpoints that enforce authentication, the terminal endpoint allowed any client to establish an interactive shell as the Marimo process user without any credentials. This access is particularly dangerous as Marimo notebooks often run on hosts with significant resources, including GPU access, large datasets, and cloud provider credentials.
Upon gaining initial access, the attacker harvested cloud credentials from both the host's process environment and the application's Redis backend. These credentials were then used to access the victim's AWS account. A key discovery was an SSH private key retrieved from AWS Secrets Manager, which the attacker subsequently used to connect to an internet-reachable bastion host, marking a rapid lateral movement.
While the eight-second compromise of the bastion host was remarkably fast, Sysdig noted that the attacker had spent approximately four hours in earlier sessions building and refining a custom Python toolkit. This toolkit comprised eight scripts, pre-positioned on the host, allowing for the execution of a complete attack chain with a single command upon reconnection. During a subsequent nine-hour session, the attacker executed over 850 interactive commands, none of which appeared to be from recognizable public offensive tooling.
Intriguingly, the attacker bypassed a specific trap designed by Sysdig to detect AI-driven exploitation. This trap involved a directive within the vulnerable container that would cause any LLM reading a particular file to echo a hidden marker. While every AI-driven operator previously profiled against this flaw had triggered the trap, this human attacker inspected the file twice without echoing the marker, providing a clear signature of non-AI activity.
Sysdig emphasized that detection strategies cannot solely rely on identifying the fingerprints of AI agents. Both AI-generated and human-typed command streams can lead to the same critical outcomes, such as accessing Secrets Manager, exfiltrating SSH keys, and establishing connections to bastion hosts. The focus, therefore, must shift to analyzing the overall attack chain and its objectives rather than the method of command generation.
To mitigate this threat, Sysdig recommends updating Marimo to version 0.23.0, implementing authentication for the terminal endpoint, or disabling it entirely. Furthermore, organizations should restrict the permissions of Secrets Manager so that notebook credentials cannot access sensitive bastion host keys. Any credentials exposed on reachable instances should also be rotated promptly.
CVE-2026-39987 has been on CISA's Known Exploited Vulnerabilities (KEV) catalog for several months, with a federal remediation deadline of May 7, 2026, underscoring the urgency for organizations to patch this critical vulnerability.