A threat actor exploited a pre-authentication remote code execution flaw in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in eight seconds.
Tracked as CVE-2026-39987, the vulnerability affects marimo versions through 0.20.4. The flaw stems from missing authentication on /terminal/ws, exposing an interactive PTY shell to remote clients able to connect.
Marimo version 0.23.0 fixes the issue by adding the missing authentication validation. Sysdig observed the operator use the access to run an end-to-end cloud pivot chain during a nine-hour intrusion.
Marimo RCE Flaw
The attacker opened a WebSocket session, recovered AWS credentials from the compromised notebook environment and its Redis-backed application data, called Secrets Manager, wrote a private key to /tmp/bastion_key, and used it to access an internet-facing bastion.
At 18:57:22 UTC, a WebSocket session began. Four seconds later, the attacker recovered an AWS key from the application’s stored credentials. At 18:57:30, SSH authentication to the bastion was recorded.
The compressed sequence shows how quickly a prepared toolkit can turn notebook compromise into deeper cloud access.
Unlike previously tracked operators exploiting the same bug, this actor appeared to rely on hand-built automation rather than LLM-generated tooling.
Over several hours, they dropped base64-encoded Python scripts into /tmp/ and iteratively refined boto3 and SSH routines.
The scripts used AWS region fallbacks, Secrets Manager queries, JSON parsing, and Paramiko key-type detection. Base64 encoding also reduced exposure of multi-line source code in bash history.
The actor also attempted an alternative route through EC2 Instance Connect. After DescribeInstances, DescribeKeyPairs, and DescribeInstanceInformation requests were denied, automation attempted ec2:SendSSHPublicKey against the placeholder instance ID i-0000000000000000.
That failed attempt offers defenders a high-confidence behavioral signal when paired with the preceding denied enumeration activity.
Observed infrastructure included 172.236.12.17, used for WebSocket activity, and 45.79.187.72, used as a callback listener on TCP port 4444. Both addresses were associated with AS63949, Akamai Connected Cloud/Linode.
Other indicators include /tmp/chain.py, /tmp/full_chain.py, /tmp/bastion_key, nohup Python executions, and base64-decoded scripts.
Defenders should upgrade marimo to 0.23.0 or later, place authentication controls in front of /terminal/ws, or disable the terminal feature on internet-exposed notebooks.
Organizations should remove cloud credentials from notebook environments, tightly scope Secrets Manager access, restrict outbound container egress, and rotate credentials exposed on reachable instances.
Detection should prioritize the attack chain rather than command syntax: environment or .env access, unusual Secrets Manager requests, cross-region retries, followed by outbound connections to public non-standard ports or SSH activity. The case shows skilled operators can reach machine-speed post-exploitation without AI.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
