CVE-2026-39987 is a pre-authentication remote code execution vulnerability in marimo, a reactive Python notebook: its terminal WebSocket endpoint (/terminal/ws) skips the authentication check applied to other WebSocket endpoints, letting a remote, unauthenticated attacker obtain a full interactive shell and run arbitrary system commands, often with root privileges in containerized deployments.
Vulnerability summary
9.8
Critical
99.6%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-04-09
Published
Vulnerability ID: CVE-2026-39987 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| marimo | cpe:2.3:a:coreweave:marimo:*:*:*:*:*:python:*:* | before 0.23.0 (fixed in 0.23.0) |
What this means
CVE-2026-39987 is a missing-authentication-for-critical-function vulnerability (CWE-306) in marimo, a reactive Python notebook maintained under the marimo-team/CoreWeave project. The GitHub Security Advisory states: "The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints that properly implement validate_auth(), the terminal endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification" (GitHub Security Advisory GHSA-2679-6mx9-h9xc).
NVD's own analysis assigns a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. GitHub's own CVSS v4.0 score for the same issue is 9.3 (critical) (NVD).
The affected range is marimo versions prior to 0.23.0, which contains the fix; the GitHub advisory's remediation guidance calls for adding authentication validation to /terminal/ws matching the existing /ws endpoint's implementation, and for terminal functionality to require explicit enablement rather than defaulting to available (GitHub Security Advisory GHSA-2679-6mx9-h9xc).
Sysdig's research team documented the practical speed of exploitation, reporting observed attacker activity against exposed marimo instances within hours of public disclosure and describing the vulnerability as trivially weaponizable against any instance left reachable on the network without a reverse proxy enforcing authentication (Sysdig).
CISA added CVE-2026-39987 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-23, with a required-action due date of 2026-05-07. Catalog version 2026.10.29, 1,764 entries, confirmed live this run by matching the exact cveID string in the raw feed (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.9956 (99.946th percentile) — among the highest EPSS scores observed, consistent with a trivially-reachable, unauthenticated shell-access bug that was mass-scanned and exploited within hours of disclosure (FIRST EPSS).
Any internet-reachable marimo deployment on a version before 0.23.0 should be upgraded immediately; operators who cannot upgrade right away should place the instance behind an authenticating reverse proxy and block direct access to /terminal/ws from untrusted networks.
Evidence
- The /terminal/ws WebSocket endpoint skips the authentication check applied elsewhere, letting an unauthenticated attacker obtain a full PTY shell and execute arbitrary system commands. — GitHub Security Advisory
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
- Affected versions are before 0.23.0, fixed in 0.23.0; remediation requires authentication validation on the terminal endpoint. — GitHub Security Advisory
- Sysdig observed attacker activity against exposed marimo instances within hours of public disclosure. — Sysdig
- Added to the CISA KEV catalog on 2026-04-23, required-action due date 2026-05-07. Catalog version 2026.10.29, 1,764 entries, confirmed live this run. — CISA KEV
- EPSS score is 0.9956 (99.946th percentile) as of 2026-10-30. — FIRST EPSS
