A critical flaw in the Marimo open-source Python notebook platform has enabled threat actors to steal AWS credentials and gain access to a bastion host in just eight seconds. Discovered by the Sysdig Threat Research Team, the vulnerability—CVE-2026-39987—impacts Marimo versions up to and including 0.20.4 and was patched in release 0.23.0.
Marimo is a tool favored by developers, data scientists, and AI teams. Because it runs notebook servers often alongside production workloads, datasets, and sensitive tokens, a compromise of Marimo can turn into a larger breach. The weakness lies in Marimo’s terminal WebSocket endpoint, which doesn’t properly verify authentication, allowing anyone to open a WebSocket connection and gain an interactive shell with the permissions of the Marimo service account—no valid credential required.
How the Attack Unfolds
Once attackers have control of that WebSocket shell, they rapidly move through the environment. According to Sysdig, the entire chain—from opening a new terminal session to authenticating into a downstream bastion host via SSH—takes about eight seconds. The foothold allows them to discover AWS credentials exposed in the host environment and in the application’s Redis backend.
Those credentials are then used to make calls to AWS Secrets Manager. In observed incidents, attackers retrieved an SSH private key from Secrets Manager and immediately used it to log into a publicly accessible bastion host (also known as a jump server). Bastion hosts are trusted gateways to internal systems, so access to them amplifies the damage potential.
Risks, Fixes, and Mitigations
This incident underlines risks in exposing developer and machine-learning infrastructure without strict security controls. Notebook servers are often provisioned quickly and given broad permissions, which can leave credentials, source repository access, internal APIs or even secret management systems open to abuse.
To remediate, users of Marimo should upgrade immediately to version 0.23.0 or newer. Organizations should also audit public-facing Marimo deployments, disable or secure terminal WebSocket endpoints, enforce strict authentication for WebSocket services, and apply least-privilege principles to roles associated with notebook workloads.
Additional defensive measures include rotating AWS credentials, SSH keys, and any API tokens that could have been exposed. Monitoring should be adjusted to catch anomalous activity such as unexpected Secrets Manager access, unusual SSH logs to bastion hosts, or rapid chained actions following access to the notebook environment.
The speed and simplicity of this attack show how quickly things escalate when any part of the cloud-privileged chain is exposed. Protecting each link—from notebook services to secret stores and SSH access—is vital.
