Marimo RCE Attack Reached an SSH Bastion in Eight Seconds

Sysdig tracks rapid Marimo-to-bastion pivot

Sysdig has documented an intrusion in which a human operator moved from a vulnerable Marimo notebook to an SSH bastion host in eight seconds. The activity exploited CVE-2026-39987, a pre-authenticated remote code execution vulnerability with a CVSS score of 9.3 that affects all versions of Marimo.

The flaw entered active exploitation within hours of public disclosure. Sysdig said the operator used a custom Python toolkit, written and debugged manually, rather than an AI agent or recognizable publicly available offensive tooling.

Credentials connected the initial foothold to SSH access

After obtaining code execution, the attacker established a full interactive shell on the Marimo instance. The next stages formed an end-to-end credential-pivot chain: credentials harvested from the compromised instance were used for an Amazon Web Services Secrets Manager call, which returned a private SSH key used to access the bastion host.

Sysdig’s timeline records a fresh WebSocket connection at 18:57:22, an application credential lookup that returned the harvested AWS key at 18:57:26, and SSH authentication at the bastion at 18:57:30. The initial access used Marimo’s exposed /terminal/ws WebSocket endpoint.

The operator condensed the credential retrieval, Secrets Manager request, key write and SSH authentication into a single backgrounded Python3 invocation. Sysdig said this workflow avoided a trap encountered by every agentic threat actor it had profiled against the same CVE.

A nine-hour interactive session

The broader session began at 12:52 p.m. with a WebSocket connection from 172.236.12[.]17 and continued until 9:50 p.m. During those nine hours, the attacker issued more than 850 interactive commands and deployed an asyncssh-style listener setup on an attacker-owned VPS.

The findings illustrate that rapid exploitation is not limited to AI-assisted operations. For businesses running Marimo, the immediate implication is to remediate CVE-2026-39987, restrict exposed notebook endpoints, limit instance access to AWS credentials and Secrets Manager, and alert on credential lookups followed by new SSH authentication to bastion systems.