Human operator executes Marimo cloud pivot in eight seconds

A skilled human attacker exploited a critical Marimo notebook flaw and moved from an exposed WebSocket session to authenticated access on an SSH bastion host in eight seconds, Sysdig’s Threat Research Team has documented.

The operation centred on CVE-2026-39987, a pre-authentication remote code execution vulnerability affecting the Marimo Python notebook platform. Sysdig said the attacker used a hand-built Python toolkit rather than an AI agent, chaining initial shell access, cloud credential use and retrieval of an SSH private key with machine-like speed.

During a nine-hour observed session, the operator issued more than 850 interactive commands and used no recognisable public offensive framework, according to Sysdig’s technical analysis published on September 11. The researchers said the attacker wrote, tested and refined scripts manually during earlier stages of the intrusion, then reused the finished tooling to accelerate later access attempts.

The fastest sequence began when a new WebSocket session was opened against the exposed Marimo terminal endpoint. Eight seconds later, Sysdig observed successful authentication to a bastion host. The chain used credentials obtained from the compromised environment to query AWS Secrets Manager and retrieve a private key needed for the SSH connection.

Sysdig’s timeline also showed that the operator had validated credentials before the first terminal activity visible to researchers, suggesting parts of the compromise began outside the captured command window and were prepared in advance.

Sysdig said the behaviour differed from agent-driven attacks it had previously observed against the same vulnerability. The operator showed signs of manual debugging, varied command construction and deliberate pacing, while avoiding a prompt-injection trap that the researchers said had caught AI-driven operators targeting CVE-2026-39987.

The attacker also developed several Python scripts during the session and transferred them in base64-encoded form into temporary directories. Sysdig said eight distinct scripts were deployed within a 17-minute period. The encoding reduced shell-quoting problems and left less readable content in command history, complicating rapid review by defenders.

Researchers identified two separate AWS credential paths used by the operator. One set was harvested from environment variables and credential files on the compromised host. Another was obtained through the application’s Redis backend. Sysdig said the credentials mapped to different IAM users and were tested as the attacker searched for access that could reveal the bastion secret.

CVE-2026-39987 was disclosed on April 8 and is rated critical. The flaw stems from missing authentication checks on Marimo’s /terminal/ws WebSocket endpoint, which can provide an unauthenticated user with a full pseudo-terminal shell when vulnerable notebook deployments are exposed.

The GitHub advisory for the vulnerability lists Marimo versions before 0.23.0 as affected and version 0.23.0 as patched. The fix added the authentication validation that was already applied to other WebSocket endpoints. Marimo advised users operating editable notebooks on public or shared networks to upgrade, while deployments protected by an external authentication proxy or running only in application mode were described as outside the principal affected configuration.

CERT-In has also classified the issue as carrying a high risk of remote code execution, unauthorised access and full system compromise, warning that successful exploitation can expose sensitive information or disrupt services.

Sysdig first observed exploitation of the flaw less than 10 hours after public disclosure in April. Subsequent activity included reverse shells, credential theft, lateral movement and deployment of an NKAbuse malware variant, indicating that exposed notebook environments became active targets soon after technical details were available.

The September case is significant because its speed did not depend on an autonomous AI workflow. Sysdig said the operator appears to have spent nearly four hours building and debugging the toolkit before later reconnections compressed the credential-and-SSH pivot to seconds.

The researchers cautioned that defenders should not treat machine-speed execution as evidence of AI involvement by itself. Human operators can pre-stage automation, reuse scripts and make rapid judgement calls once tooling is ready, while their behaviour may differ from patterns generated by large-language-model agents.