The critical vulnerability CVE-2026-39987 (CVSS 9.3) in Marimo interactive notebooks — pre-authentication remote code execution via the terminal WebSocket endpoint — has been added to the CISA KEV catalog with a remediation deadline of May 7, 2026. According to Sysdig, a skilled human operator, using their own Python tooling without any AI agent, completed the full chain from the vulnerable notebook to the SSH bastion in eight seconds — a speed researchers had previously associated exclusively with automated attacks. The vulnerability affects Marimo versions below 0.23.0; a patch is available. We have already written about vulnerabilities in Marimo before.
Technical essence of the vulnerability
According to the GitHub Advisory, CVE-2026-39987 is classified as CWE-306 — missing authentication for critical function. The /terminal/ws endpoint in Marimo accepts WebSocket connections without authentication, giving an unauthenticated attacker a full interactive shell (PTY) and the ability to execute arbitrary commands.
It is worth noting a discrepancy in the data on affected versions: the package field in the GitHub advisory lists versions below 0.23.0 as affected, while the detailed section of the same document refers to Marimo ≤ 0.20.4. Version 0.23.0 is listed as fixed.
Anatomy of the attack: nine hours, 850 commands, zero public tools
According to Sysdig (via their research), the attack chain unfolded as follows:
- 18:57:22 — WebSocket connection established to the vulnerable endpoint
- 18:57:26 — AWS credentials extracted from the application store
- 18:57:30 — SSH authentication to the bastion host using a private key from AWS Secrets Manager
Eight seconds from the first connection to full control over the bastion. As Sysdig reports, the operator used a single background Python3 invocation, which in one script extracted the credentials, retrieved the SSH key from Secrets Manager, wrote it to disk, and authenticated to the bastion.
Over the nine-hour session (from 12:52 to 21:50), the attacker executed more than 850 interactive commands without using a single known public offensive tool. All scripts were written and debugged manually directly in the session. Sysdig emphasizes in particular: the operator bypassed a trap that every autonomous AI agent profiled by them fell into when attacking the same vulnerability.
The source of the initial connection was IP address 172.236.12[.]17. During the session, the attacker deployed an asyncssh-style listener on their own VPS.
Context: AI accelerates attacks but does not replace mastery
This incident illustrates an important point: while AI tools shorten the time from vulnerability discovery to exploitation and lower the barrier to entry for less skilled attackers, experienced operators can act at the same speed without automation — and at the same time evade defensive mechanisms more effectively. As Sysdig notes, AI is changing the economics of attacks (more targets, faster exploitation, less routine), but has not yet replaced a skilled attacker who can build tools from scratch and avoid traps.
Parallel campaigns: Redis and Dahua
Cryptomining via Redis
In parallel with the events around Marimo, Hunt.io disclosed a cryptomining campaign in which 3,562 Redis servers were compromised out of a list of 12,966 hosts discovered by scanning port 6379. Among the preselected servers without authentication (2,342 hosts), the compromise rate reached 72.6%.
Victims were running Redis versions from 2.8.17 (2015) to 7.2.0 (2023) and Linux from legacy RHEL/CentOS 6 to current Ubuntu kernels. Hunt.io notes that the cause of the mass compromise was the lack of authentication, not a vulnerability in a specific Redis version.
The main method was the SLAVEOF command for rogue replication, which was used to deliver the XMRig miner to the target server. Of the four techniques tried, only replication worked at scale: SSH key injection via AOF and attempts to escape a MongoDB sandbox yielded no results in 2,810 attempts. A WordPress compromise chain was identified but not confirmed at scale. The campaign has not been attributed to any known threat group.
Indicators of compromise from the research: IP addresses 47.250.92[.]230, 34.166.99[.]116, 20.198.10[.]42, 188.245.99[.]156; domain pool.moneroocean[.]stream.
Operation CameraSwarm
According to the Hunt.io blog index, as part of Operation CameraSwarm, more than 14,530 Dahua IP cameras in Ukraine and Russia were compromised over 35 days. The attack used brute force and authentication bypass vulnerabilities CVE-2021-33044 and CVE-2021-33045 (both CVSS 9.8, CWE-287), as well as a P2P relaying technique. Both Dahua vulnerabilities have been included in the CISA KEV catalog since August 2024.
Impact assessment
Organizations most at risk from CVE-2026-39987 are those using Marimo for interactive computing in cloud environments, especially where there is access to AWS Secrets Manager from the same instance. The “WebSocket → credentials → SSH bastion” chain shows how a single vulnerability in a data analysis tool can lead to full compromise of cloud infrastructure.
The campaign against Redis underscores the scale of the problem of open databases without authentication: 72.6% of unprotected servers were compromised.
Recommendations
- Marimo: immediately update to version 0.23.0 or higher. If updating is not possible, block access to the
/terminal/wsendpoint at the network control level - AWS: audit instances running Marimo for access to Secrets Manager. Rotate SSH keys and AWS credentials stored in Secrets Manager if the instance was exposed externally
- Redis: enable authentication (
requirepass), restrict network access to port 6379, disable theSLAVEOFcommand viarename-command - Dahua: update device firmware to versions that fix CVE-2021-33044 and CVE-2021-33045, change default credentials
- Check for the listed IOCs in network logs
The Marimo incident is a clear demonstration that defensive strategies designed to detect automated attacks are insufficient: a skilled operator can go from vulnerability to full control in seconds, using only custom code and avoiding typical indicators. The priority is to update Marimo to 0.23.0 and audit the access chain from computational notebooks to the secrets of cloud infrastructure.
