Marimo: pre-auth RCE in the Python notebook (CVE-2026-39987)

Unauthenticated code execution in the Marimo Python notebook before 0.23.0, CVSS 9.8. Update to 0.23.0.

On 9 April 2026 the record for CVE-2026-39987 was published, a pre-authentication vulnerability in Marimo, the reactive Python notebook. Before version 0.23.0, the /terminal/ws WebSocket endpoint did not check authentication as the other endpoints did, and an unauthenticated attacker could obtain a PTY shell. The NVD score is CVSS v3.1 9.8.

The vulnerability is in CISA's KEV catalogue. According to Sysdig, exploitation appeared within less than ten hours of disclosure: the time between publication and attack was very short.

Update to version 0.23.0 or later. Those running Marimo in shared or cloud environments should make sure the service port is not reachable from untrusted networks, and review terminal logs for unrecognised sessions.

At a glance

What: Shell access without authentication through the /terminal/ws WebSocket endpoint, which skips the check present on other endpoints.
Severity: CVSS v3.1 9.8 (NVD); CVSS v4.0 9.3 (GitHub).
Cause: Missing authentication on the WebSocket endpoint (CWE-306).
Fix: Marimo 0.23.0.
Status: Listed in the CISA KEV catalogue. According to Sysdig, exploitation appeared within ten hours of disclosure.
Action: Update to 0.23.0. Do not expose notebooks to untrusted networks and limit access to the service port.

Sources: NVD, CVE-2026-39987 · GitHub, advisory GHSA-2679-6mx9-h9xc · CISA, catalogo KEV

← All articles