CVE-2026-39987: Marimo Remote Code Execution Vulnerability

Marimo contains a pre-authorization remote code execution vulnerability. An unauthenticated attacker can obtain shell access and execute arbitrary system commands on affected instances. The issue matters because it allows direct remote compromise without credentials.

How it works

The weakness is categorized as CWE-306, Missing Authentication for Critical Function. The product exposes functionality that permits command execution before any authentication check occurs.

An attacker can reach the affected endpoint or interface directly and issue system commands. No valid session or credentials are required. Specific request patterns or parameters that trigger the flaw must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Marimo instances are typically deployed as self-hosted applications or services that accept external connections. Inventory all deployments by scanning for the product name in container registries, package managers, configuration management databases, and cloud workloads.

• Review running processes and network listeners for Marimo services.
• Check installed packages and application manifests for the product.
• Examine authentication configuration files to identify any missing or bypassed checks on critical endpoints.
• Monitor logs for unauthenticated requests that result in shell or command execution activity.

Exact versions and configurations to test must be confirmed against the vendor advisory.

How to remediate

Apply mitigations per the vendor instructions. For cloud-hosted instances, follow applicable BOD 22-01 guidance. If mitigations cannot be applied, discontinue use of the product.

• Prioritize the update or configuration change named in the advisory.
• Verify that authentication is enforced on all endpoints that permit command execution after the change.
• Re-scan affected systems to confirm the control is in place.

If you can't patch immediately

Until the vendor mitigation can be applied, reduce exposure through network controls and access restrictions. Segment Marimo instances so they are reachable only from trusted management networks. Disable or restrict the affected feature if the product permits it. Monitor inbound traffic and process execution for signs of unauthorized command activity. If no effective controls are available, discontinue use of the product as stated in the CISA required action.

If your data may have been exposed

Pre-authorization remote code execution can lead to full system compromise and data access. Organizations can run a free exposure scan of their email addresses to check against known breach data.