← Back to feed
2026-04-13 Supply ChainMalicious Tool TLP:CLEAR

Marimo Pre-Authentication RCE (CVE-2026-39987): Critical AI Development Toolchain Compromise via WebSocket Terminal

Date: 2026-04-13
Tags: supply-chain, malicious-tool

Executive Summary

CVE-2026-39987 is a critical pre-authentication remote code execution vulnerability (CVSS v4.0: 9.3) in Marimo, a reactive Python notebook, actively exploited in early April 2026 targeting AI researchers and developers at Stanford, Mozilla AI, OpenAI, and BlackRock. Attackers focused on obtaining LLM provider API keys and cloud credentials within minutes of gaining shell access, representing the initial access phase of AI supply chain attack scenarios.

Campaign Summary

FieldDetail
Campaign / MalwareMarimo Toolchain Compromise Wave
AttributionOpportunistic threat actors (confidence: medium)
TargetAI research teams, ML engineers, enterprise development environments
VectorUnauthenticated WebSocket terminal endpoint in Marimo notebook interface
Statusactive
First Observed2026-04-06

Detailed Findings

Marimo is actively used by engineering and research teams at organizations including Stanford, Mozilla AI, OpenAI, and BlackRock, with approximately 19,600 GitHub stars. The application maintains multiple WebSocket endpoints to handle real-time notebook cell execution, UI widget state, and an integrated browser terminal that provides shell access to the environment running the Marimo process. The vulnerability disclosure occurred on April 10, 2026, with exploitation attempts confirmed within hours of public disclosure via Endor Labs honeypot analysis.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Remote code execution via unauthenticated WebSocket endpoint in AI development tool
Credentials from Password StoresT1555Attackers enumerated and exfiltrated LLM provider API keys and cloud credentials post-compromise
Supply Chain CompromiseT1195Compromise of AI development infrastructure as vector for downstream supply chain poisoning

IOCs

Domains

_CVE-2026-39987 affects Marimo versions prior to patched release; no specific IOCs published; honeypot telemetry from Endor Labs and Sysdig (April 2026) documents exploitation activity_

Full URL Paths

_CVE-2026-39987 affects Marimo versions prior to patched release; no specific IOCs published; honeypot telemetry from Endor Labs and Sysdig (April 2026) documents exploitation activity_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

marimo

Detection Recommendations

Monitor for WebSocket connections to Marimo instances; alert on shell command execution within Marimo terminal endpoints, particularly commands enumerating environment variables (env, printenv, aws configure list, gcloud config list). Search logs for access to .env files, ~/.aws, ~/.ssh, and cloud credential stores post-compromise. Implement network segmentation to isolate Marimo instances from production LLM provider credentials; rotate all LLM API keys, cloud credentials, and Hugging Face tokens if Marimo instances were exposed.

References