marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass (CVE-2026-39987)

What is affected, what to do

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability.

The vulnerability is being actively exploited; treat it as a priority. Update Marimo to version 0.23.0. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Marimo lt *..0.23.0

Fixed in

• Marimo 0.23.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Locate every marimo deployment — pip show marimo / pip list | grep -i marimo across venvs, containers and shared notebook servers, plus a network sweep for marimo's default port 2718 (unless overridden via --port). Edit-mode instances (marimo edit) are the primary concern, since /terminal/ws only checks run mode and platform support before accepting a connection.
   • Patch: Upgrade to marimo 0.23.0 or later (pip install --upgrade "marimo>=0.23.0"), rebuild container images and restart running processes. All versions prior to 0.23.0 are affected.
   • Cut exposure now: Stop any marimo server reachable from the internet or from user VLANs until patched, or restrict it via host firewall to 127.0.0.1 or an admin network. Never bind to 0.0.0.0 (--host 0.0.0.0) without an authenticating proxy in front.
   • Compromise assessment: For every exposed instance, review web server/proxy logs for requests to /terminal/ws. Any hit from an unknown source IP means treat the host as compromised: isolate it and preserve evidence (memory image, shell history, /tmp, crontabs, ~/.ssh/authorized_keys).
   • Rotate credentials: Notebook hosts routinely hold cloud keys, database passwords and API tokens (environment variables, .env, ~/.aws/credentials, ~/.config). For every exposed, unpatched instance, rotate all secrets reachable from that host — whether or not access has been confirmed.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move data-science/notebook hosts into a dedicated segment; allow inbound access to port 2718 (or the configured port) only via jump host or VPN. Restrict egress to required package repositories and data sources to frustrate reverse shells and exfiltration.
   • Reverse proxy/WAF: Front marimo with a reverse proxy (nginx, Traefik, Envoy) enforcing authentication (OIDC/SSO, mTLS). Until patched, hard-block WebSocket upgrades on /terminal/ws, e.g. nginx: location ^~ /terminal/ws { return 403; }.
   • IPS rule: Suricata/Snort signature matching HTTP requests with URI /terminal/ws and Upgrade: websocket towards notebook segments from non-approved source networks — alert everywhere, block where inline.
   • Endpoint hardening: Run marimo as a dedicated unprivileged service account with no sudo and no Docker socket access; in containers use --read-only, never --privileged, and drop capabilities. Serve production apps with marimo run rather than marimo edit.
   • IAM/least privilege: Provision only short-lived, narrowly scoped credentials on notebook hosts (workload identity, time-bound STS tokens) instead of long-lived admin keys.
3. 03

   Runbook step 3

   Detection rules

   • Web/proxy logs: Requests to /terminal/ws returning HTTP 101 (Switching Protocols) from source IPs outside the allowlist. SPL: index=proxy uri_path="/terminal/ws" status=101 NOT src_ip IN (<admin_nets>) | stats count by src_ip, dest, _time.
   • Network telemetry (Zeek/Suricata): Zeek http.log entries with uri == "/terminal/ws" and an upgrade header, or websocket.log sessions to notebook hosts; correlate with new outbound connections from those hosts to unfamiliar IPs (e.g. 4444, 1337, 443) shortly after the WebSocket handshake.
   • Process ancestry (EDR, Sysmon for Linux EID 1, auditd execve): python/marimo → bash/sh → curl, wget, nc, base64, chmod +x, python -c. Sigma shape: ParentImage|endswith: '/python3' AND ParentCommandLine|contains: 'marimo' AND Image|endswith: ['/curl','/wget','/nc','/bash']. Legitimate terminal use by data scientists produces the same chain — correlate with the WebSocket source IP.
   • Persistence and credential access: auditd watches (-w ~/.ssh/authorized_keys -p wa, -w /etc/crontab -p wa) plus reads of ~/.aws/credentials, .env files and /proc/*/environ by shell children of the marimo service.
   • Cloud audit logs: API calls using the notebook host's credentials from foreign source IPs, or unusual calls such as GetCallerIdentity, ListBuckets, or new IAM key creation (CloudTrail, Azure Activity Log, GCP Audit Logs).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Marimo-team Marimo

Weakness classes (CWE)

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• github.commarimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xcweb, x_refsource_CONFIRM, Exploit, Mitigation, Vendor advisory
• NVD (NIST)vuln/detail/CVE-2026-39987advisory
• github.commarimo-team/marimo/pull/9098web, x_refsource_MISC, Issue tracking, Patch
• github.commarimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd…web, x_refsource_MISC, Patch
• github.commarimo-team/marimopackage
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39987web
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987web, government-resource, US government resource
• sysdig.comblog/marimo-oss-python-notebook-rce-from-disclosure-to-exploita…web, Third-party advisory, Exploit, Third-party advisory
• pypi.orgproject/marimopackage
• GitHub Security Advisoriesadvisories/GHSA-2679-6mx9-h9xcadvisory

Linked advisories

• Ten CVEs Added to CISA KEV, Four with a Three-day Mitigation WindowSANS NewsBites21.04.2026