Marimo RCE Flaw Exploited in Rapid AWS Credential Theft and Cloud Pivot
A threat actor exploited a critical pre-authentication remote code execution (RCE) vulnerability in marimo (CVE-2026-39987) to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in just eight seconds. The flaw, affecting marimo versions up to 0.20.4, stemmed from missing authentication on the /terminal/ws endpoint, exposing an interactive PTY shell to remote attackers.
The attack began at 18:57:22 UTC, when the operator opened a WebSocket session. Within four seconds, they extracted AWS credentials from the compromised notebook environment and its Redis-backed application data. By 18:57:30 UTC, the attacker had used the stolen key to access an internet-facing bastion host, demonstrating how quickly a prepared toolkit can escalate a notebook compromise into deeper cloud access.
Over a nine-hour intrusion, the threat actor deployed base64-encoded Python scripts in /tmp/, refining boto3 and SSH routines with AWS region fallbacks, Secrets Manager queries, and Paramiko key detection. Unlike other operators exploiting the same flaw, this attacker relied on hand-built automation rather than AI-generated tooling.
The operator also attempted an alternative attack path via EC2 Instance Connect, issuing DescribeInstances, DescribeKeyPairs, and DescribeInstanceInformation requests before failing to execute ec2:SendSSHPublicKey against a placeholder instance ID (i-0000000000000000). This failed attempt, paired with denied enumeration activity, provides defenders with a high-confidence behavioral signal.
Observed infrastructure included:
- 172.236.12.17 (WebSocket activity)
- 45.79.187.72 (callback listener on TCP port 4444)
Both IPs were linked to AS63949 (Akamai Connected Cloud/Linode).
Additional indicators include:
/tmp/chain.py,/tmp/full_chain.py,/tmp/bastion_keynohupPython executions- Base64-decoded scripts
The vulnerability was patched in marimo 0.23.0, which added missing authentication validation. The incident underscores how skilled operators can achieve machine-speed post-exploitation without AI assistance, emphasizing the need for robust detection of attack chains such as unusual Secrets Manager requests, cross-region retries, and outbound connections to non-standard ports.
Source: https://cyberpress.org/marimo-rce-flaw-lets-hackers-steal-aws-credentials-and-pivot/
marimo cybersecurity rating report: https://www.rankiteo.com/company/marimo-io
Akamai Technologies cybersecurity rating report: https://www.rankiteo.com/company/akamai-technologies
"id": "MARAKA1789468190",
"linkid": "marimo-io, akamai-technologies",
"type": "Vulnerability",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Cloud infrastructure'}],
'attack_vector': 'Exploitation of unauthenticated WebSocket endpoint '
'(/terminal/ws)',
'data_breach': {'sensitivity_of_data': 'High (AWS Secrets Manager data, SSH '
'keys)',
'type_of_data_compromised': 'AWS credentials, SSH private '
'key, application data'},
'date_detected': '18:57:22 UTC',
'description': 'A threat actor exploited a critical pre-authentication remote '
'code execution (RCE) vulnerability in marimo (CVE-2026-39987) '
'to harvest AWS credentials, retrieve an SSH private key from '
'AWS Secrets Manager, and authenticate to a bastion host in '
'just eight seconds. The flaw affected marimo versions up to '
'0.2.0.4 and stemmed from missing authentication on the '
'`/terminal/ws` endpoint, exposing an interactive PTY shell to '
'remote attackers.',
'impact': {'data_compromised': 'AWS credentials, SSH private key, application '
'data from Redis-backed storage',
'identity_theft_risk': 'High (SSH private key and AWS credentials '
'compromised)',
'operational_impact': 'Unauthorized cloud access, potential '
'lateral movement',
'systems_affected': 'Marimo notebook environment, AWS Secrets '
'Manager, bastion host, EC2 instances'},
'initial_access_broker': {'entry_point': 'Exploitation of CVE-2026-39987 '
'(marimo RCE flaw)',
'high_value_targets': 'AWS Secrets Manager, bastion '
'host'},
'lessons_learned': 'Skilled operators can achieve machine-speed '
'post-exploitation without AI assistance. Robust detection '
'of attack chains (e.g., unusual Secrets Manager requests, '
'cross-region retries, and outbound connections to '
'non-standard ports) is critical.',
'post_incident_analysis': {'corrective_actions': 'Patch marimo to version '
'0.23.0 or later, implement '
'enhanced monitoring for AWS '
'Secrets Manager access and '
'outbound connections to '
'non-standard ports.',
'root_causes': 'Missing authentication on '
'`/terminal/ws` endpoint in marimo '
'versions up to 0.2.0.4'},
'recommendations': 'Apply patches for marimo (version 0.23.0 or later), '
'monitor for unusual AWS Secrets Manager access, and '
'detect outbound connections to non-standard ports.',
'references': [{'source': 'Incident Report'}],
'response': {'enhanced_monitoring': 'Detection of unusual Secrets Manager '
'requests, cross-region retries, and '
'outbound connections to non-standard '
'ports',
'remediation_measures': 'Patch applied (marimo 0.23.0)'},
'title': 'Marimo RCE Flaw Exploited in Rapid AWS Credential Theft and Cloud '
'Pivot',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-39987'}