Marimo WebSocket RCE abused after CVE-2026-39987 disclosure

Attackers are exploiting **CVE-2026-39987** in **Marimo** to reach the **/terminal/ws** WebSocket endpoint and obtain unauthenticated remote code execution on exposed deployments. The flaw affects versions **0.20.4 and earlier** and was fixed in **0.23.0**. Sysdig observed the first exploitation attempt about **9 hours and 41 minutes** after disclosure and reported that the attacker turned advisory details into a working exploit. The activity included a full PTY shell, manual reconnaissance, repeated returns to the honeypot, and attempts to read **.env** data and search for SSH keys. Broader activity around the disclosure added at least **125 IP addresses** performing reconnaissance within the first **12 hours** and then moving into credential theft behavior. The observed sequence focused on shell validation, discovery commands, and harvesting environment variables, cloud credentials, and application secrets, with no miners or backdoors installed in the observed activity. Marimo released **0.23.0**, and CISA listed **CVE-2026-39987** in the Known Exploited Vulnerabilities catalog with a remediation deadline of **2026-05-07**; available evidence does not quantify how many deployments were reached.