Eight seconds — that is how quickly a human attacker moved from a vulnerable Marimo notebook to an SSH bastion host after exploiting CVE-2026-39987, according to a technical write-up published on September 11 by Sysdig's Threat Research Team.
The eight-second leap to a bastion
Sysdig reconstructed an incident in which an operator, working without any detectable large language model (LLM) assistance, exploited a pre-authentication remote code execution flaw in Marimo notebooks and, in a single reconnection, pivoted to an internet-reachable SSH bastion host in eight seconds. The write-up emphasizes that the eight-second interval describes only the rapid lateral movement executed after the attacker launched a finished command chain; prior development and staging happened over hours.
CVE-2026-39987 and Marimo's terminal WebSocket
The vulnerability, tracked as CVE-2026-39987, affected Marimo up to and including version 0.20.4 and is fixed in 0.23.0. Sysdig said the flaw resided in the terminal WebSocket endpoint, which skipped the authentication check applied to other Marimo WebSocket endpoints. Any client that opened a connection to that endpoint received an interactive shell as the Marimo process user with no credentials. Sysdig highlighted the platform's typical placement alongside machine learning pipelines and on hosts that provide GPU access, large datasets and credentials for AWS, GCP and model providers — making a compromised notebook an entry point to cloud accounts.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadThe attacker's toolkit and a nine-hour session
According to Sysdig, the operator spent roughly four hours in earlier sessions building and debugging a Python toolkit by hand, then left eight scripts on the host so a later single command would fire the finished chain. Over a nine-hour session the attacker logged more than 850 interactive commands and used no recognizable public offensive tooling. From the compromised notebook the operator harvested cloud credentials from two host surfaces — the process environment and the application's Redis backend — and replayed them against an AWS account. One of those replays returned an SSH private key stored in AWS Secrets Manager, which the operator then used to authenticate to the bastion host.
The bait for AI agents — and the tell that it failed
Sysdig deliberately planted a directive in the vulnerable container intended to detect LLM-driven operators: a prompt-injection trap telling any model that read a particular file to echo a hidden marker into its output. Every AI-driven operator profiled against this flaw echoed that marker. The human operator inspected the same file twice and did not echo the marker. Sysdig described that negative result as "its clearest non-LLM signature to date," and used it to underline a core finding: the presence or absence of LLM-style artifacts is not a reliable standalone detection signal.
Sysdig's practical remediation checklist
Sysdig recommends several concrete steps. First, update Marimo to 0.23.0. Second, put the terminal WebSocket endpoint behind authentication or disable it entirely. Third, scope Secrets Manager permissions so a notebook's credentials cannot read a bastion key. Finally, rotate any credentials or keys that have been exposed on an internet-reachable instance. Sysdig framed these controls around the observation that different operator types — human and LLM-assisted — will generate very different command streams but can converge on the same critical actions: a Secrets Manager call, SSH key exfiltration or handoff, and a bastion connection.
How Technologists and security teams, Enterprises and procurement leaders, and CISA and regulators should respond
- Technologists and security teams: Patch Marimo installations to 0.23.0, enforce authentication on terminal endpoints or disable them, scope Secrets Manager roles, and rotate exposed credentials after any compromise — measures Sysdig lists as immediate mitigations.
- Enterprises and procurement leaders: Reassess deployments of notebook infrastructure that sit next to ML pipelines or hold cloud credentials. Limit what notebook process identities can access in Secrets Manager and other secrets stores to reduce blast radius.
- CISA and regulators: Note that CVE-2026-39987 has been on CISA's Known Exploited Vulnerabilities (KEV) catalog for months, carrying a federal remediation deadline of May 7, 2026; enforcement and visibility into patching metrics for affected systems will shape downstream risk.
Sysdig's account underlines a stark operational point: attackers who work by hand can reach machine-like velocities if they prepare toolchains in advance and execute a single triggered sequence. Whether the adversary types quickly or an LLM prints a rapid stream of commands, the sequence of privileged calls and key retrievals remains the meaningful detection surface. Updating Marimo, locking down terminal endpoints, narrowing Secrets Manager permissions and rotating exposed secrets are specific steps that mirror the exact attack chain Sysdig observed — and that federal guidance has required organizations to address since the CVE entered the KEV catalog.
