Missing Authentication for Critical Function in Marimo - CVE-2026-39987
Published: April 17, 2026 / Updated: August 21, 2026
Vulnerability identifier: #VU126426
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39987
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary system commands.
The vulnerability exists due to missing authentication for a critical function in the terminal/ws WebSocket endpoint when handling WebSocket connections. A remote attacker can connect to the endpoint to execute arbitrary system commands.
The issue can expose a full interactive shell without authentication.
Affected software
Marimo
How to mitigate CVE-2026-39987
Install security update from vendor's website.
Marimo - update to 0.23.0
Links to Public Exploits and PoC-codes
- Exploit #12960 - CVE-2026-39987 (CVE-2026-39987 — Marimo Pre-Authentication RCE) (August 21, 2026)
- Exploit #12955 - CVE-2026-39987.py (This python script exploit the vulnerable marimo /terminal/ws endpoint and returns a interactive shell.) (August 21, 2026)
- Exploit #12893 - CVE-2026-39987-POC (CVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)) (August 14, 2026)
- Exploit #12878 - Public_CVEs_Exploit (The following CVEs doesn't belong to me. The exploits were completely made for the research and the educational purpose.) (August 6, 2026)
- Exploit #12593 - CVE-2026-39987 (CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE (CVSS 9.3). Python & Nmap NSE detection scripts. Missing authentication on /terminal/ws WebSocket endpoint gives attackers a full PTY shell without any credentials. Exploited in the wild (April 17, 2026)
- Exploit #12592 - CVE-2026-39987_exploit () (April 17, 2026)