Sysdig discovered a threat actor exploiting a Marimo vulnerability with alarming speed—gaining SSH bastion access just eight seconds after initial foothold. The attack chain was executed entirely by a human, using Python scripts developed over hours—not by AI agents. This incident highlights that some adversaries can still match machine-like efficiency without automated help.
What Went Wrong: Marimo’s Critical Endpoint
The issue stems from CVE-2026-39987, a pre-authentication remote code execution (RCE) flaw in Marimo notebooks (versions ≤ 0.20.4). The terminal WebSocket endpoint,
/terminal/ws, lacks authentication checks, unlike other WebSocket endpoints like
/ws, which correctly call validate_auth(). Attackers can connect directly to
/terminal/ws and execute arbitrary system commands without any credentials. Marimo 0.23.0 addresses the issue. The vulnerability carries a CVSS score of 9.3 (critical severity). Affects all versions below 0.23.0.
The Exploit Unpacked: From WebSocket to SSH Bastion in 8 Seconds
The actor started with a WebSocket connection to the Marimo terminal endpoint, then harvested AWS credentials from the compromised machine. They used those credentials to call AWS Secrets Manager and retrieve a private key, which they used to SSH into a bastion host—all in just eight seconds. No AI-assisted attack agent was involved. The operator hand-coded a Python toolkit, refining it over several hours, then stored it on disk and reused it to execute the chain rapidly.
The full timeline reveals the precision: a fresh WebSocket connection, credential lookups, then an SSH connection—all within seconds. Later, repeat sessions used scripts dropped into temporary directories, proper file permissions for stored keys, fallback logic across AWS regions, and busy-box style iteration of credentials and scripts.
Why This Attack Matters Beyond the Speed
This incident shines a light on a less discussed but highly dangerous class of attackers: skilled humans who exploit misconfigurations and vulnerabilities at exemplary speed without relying on AI. Their tactics—manual script crafting, region fallback, credential and key harvesting—demonstrate deep operational competence.
Defenders remain focused on detecting AI-driven threats and automated tools, but this case underlines that traditional tradecraft still poses critical risks. Monitoring behavior patterns like non-historical API usage, cross-region credential trials, and sudden SSH bastion access can be as crucial as fingerprinting tools.
For organizations using Marimo notebooks, upgrading to version 0.23.0 is essential. Also crucial: restricting permissions, locking down AWS credentials and role assignments, limiting network egress, and enhancing visibility (CloudTrail, process logs, WebSocket traffic).
This isn’t just about one vulnerability; it’s about the evolving threat landscape. Attackers are bridging gaps and shrinking windows between discovery and impact—often faster than AI-powered models can. Vigilance, swift patching, and behavioral detection will continue to make the difference in cybersecurity.
