Missing Authentication for Critical Function in Marimo - CVE-2026-39987
Published: April 17, 2026 / Updated: August 6, 2026
Vulnerability identifier: #VU126426
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39987
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary system commands.
The vulnerability exists due to missing authentication for a critical function in the terminal/ws WebSocket endpoint when handling WebSocket connections. A remote attacker can connect to the endpoint to execute arbitrary system commands.
The issue can expose a full interactive shell without authentication.
Affected software
Marimo
How to mitigate CVE-2026-39987
Install security update from vendor's website.
Marimo - update to 0.23.0
Links to Public Exploits and PoC-codes
- Exploit #12878 - Public_CVEs_Exploit (The following CVEs doesn't belong to me. The exploits were completely made for the research and the educational purpose.) (August 6, 2026)
- Exploit #12593 - CVE-2026-39987 (CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE (CVSS 9.3). Python & Nmap NSE detection scripts. Missing authentication on /terminal/ws WebSocket endpoint gives attackers a full PTY shell without any credentials. Exploited in the wild (April 17, 2026)
- Exploit #12592 - CVE-2026-39987_exploit () (April 17, 2026)