Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure

A critical pre-authentication remote code execution vulnerability (CVE-2026-39987, CVSS 9.3) in Marimo, an open-source Python notebook platform owned by CoreWeave, was exploited in the wild less than 10 hours after public disclosure. The flaw resides in the terminal WebSocket endpoint (/terminal/ws), which lacked authentication, allowing any unauthenticated attacker to gain a full interactive shell. Sysdig researchers deployed honeypots and observed an attacker steal AWS credentials and API tokens in under three minutes across four sessions. The incident mirrors a broader pattern of rapid exploitation of AI-adjacent developer tools like Langflow, MLflow, and n8n. Organizations should upgrade to Marimo 0.23.0 immediately, restrict external access, and rotate any credentials stored on exposed instances.