CVE-2026-39987

This flaw lets an attacker connect to a special Marimo “terminal” connection without logging in, and then run commands on the machine that runs Marimo—like getting a hidden backdoor into your server. Imagine leaving a door unlocked in a building’s computer room: the attacker doesn’t need a key and can immediately do anything the computer user can do.

This matters if you run Marimo (self-hosted or in your own environment) and you have the terminal functionality enabled. It is especially risky when the vulnerable terminal connection is reachable over the network without being blocked, because the attack does not require any login or user interaction.

This is RED because CISA has added CVE-2026-39987 to its Known Exploited Vulnerabilities list and it is already being exploited in the real world. Attackers can get command execution without credentials by using the terminal WebSocket authentication bypass, so waiting increases the chance your server is targeted and compromised.

1. Confirm exposure

   • Verify the Marimo version for the running service(s). The affected condition is Marimo versions prior to 0.23.0.
   • Confirm whether the terminal functionality is enabled in your Marimo setup.
   • Determine whether the terminal WebSocket endpoint (the terminal WebSocket path) is reachable from untrusted networks (for example, the public internet) rather than being restricted to trusted users/networks.

2. Upgrade (the permanent fix)

   • Upgrade Marimo to 0.23.0.
   • If you run multiple environments (dev/test/prod), patch them all—attackers target what’s reachable.
   • Expect no security-related configuration changes should be necessary for the fix, but confirm that the terminal feature still works as intended after the upgrade.

3. If you cannot upgrade immediately (temporary containment)

   • Disable the terminal feature in your Marimo configuration (if your deployment allows it).
   • Or block access so that untrusted users cannot reach the terminal WebSocket path (e.g., restrict by firewall, reverse proxy rules, or network segmentation so only trusted IPs/users can access it).

4. Hunt and verify after patching

   • Review server logs for evidence of unauthenticated terminal/WebSocket connections and command execution attempts.
   • Look for unexpected process launches, unusual command patterns, and abnormal outbound connections from the Marimo host.
   • If you find indicators of compromise, treat the server as potentially breached (incident response process, credential checks, and possible re-image depending on impact).

5. Timing guidance from CISA

   • CISA KEV remediation due date: 2026-05-07.
   • Prioritize upgrade/mitigation before that date, and treat any existing exploitation indicators as an emergency.

Severity: Critical (pre-auth remote code execution) with maximum impact on confidentiality, integrity, and availability as reflected in the provided scoring.

Weakness/Mechanism: CWE-306. The terminal WebSocket endpoint in Marimo lacks authentication validation. Other WebSocket endpoints enforce authentication, but /terminal/ws accepts connections after only checking runtime mode/platform support, skipping identity checks.

Attack Vector: Network-based pre-auth access. No login and no user interaction are required.

Exploitation status: CISA KEV is marked as yes (listed 2026-04-23) and a remediation due date is provided (2026-05-07). News reporting indicates active exploitation soon after disclosure, including takeover-style outcomes and rapid pivoting behavior.

Fix: The vulnerability is fixed in Marimo 0.23.0.

EPSS note: A high EPSS prediction is present and rising, but KEV/news confirmation should be treated as the controlling indicator for urgency.

Exploit maturity: Real-world incidents reported (active exploitation) indicate this is more than theoretical.