// AWSHIGH
CVE-2026-39987 in marimo notebook tool allows unauthenticated remote code execution via an unprotected WebSocket endpoint (/terminal/ws). Threat actors are actively exploiting this vulnerability to steal AWS credentials from compromised instances, retrieve SSH private keys from AWS Secrets Manager, and pivot to internal bastion hosts. Affected marimo versions up to 0.20.4; fixed in 0.23.0. A documented intrusion shows credential theft and bastion access achieved within 8 seconds.
- Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to (opens in a new tab)
- Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Ba(opens in a new tab)
// Get alerts for AWS