How HookProbe Detects CVE-2026-39987 (Marimo Marimo)

How HookProbe Detects CVE-2026-39987 (Marimo Marimo)

In the evolving landscape of data science and interactive computing, Marimo has emerged as a powerful, reactive Python notebook that challenges the traditional Jupyter paradigm. However, with great flexibility comes significant security responsibility. The discovery of CVE-2026-39987 has sent shockwaves through the community, as it describes a critical pre-authorization Remote Code Execution (RCE) vulnerability. This flaw allows unauthenticated attackers to gain shell access and execute arbitrary system commands on the host machine running the Marimo server.

At HookProbe, our mission is to provide proactive defense through our Distributed Security Mesh (DSM). In this technical deep dive, we will explore the mechanics of CVE-2026-39987 and demonstrate how HookProbe’s specialized detection engines—HYDRA, NAPSE, and AEGIS—work in tandem to neutralize this threat before it can compromise your infrastructure.

Understanding CVE-2026-39987: The Marimo Pre-Auth RCE

Marimo operates by maintaining a reactive graph of Python cells. When a cell is modified, Marimo automatically updates dependent cells. This architecture relies on a robust communication layer between the browser-based UI and the backend Python kernel, typically handled via WebSockets and REST API endpoints.

CVE-2026-39987 stems from an insufficient validation check in the Marimo kernel's message handling logic. Specifically, the vulnerability resides in the /api/kernel/instantiate endpoint, which is responsible for initializing the reactive state. Under certain conditions, this endpoint fails to verify the session token, allowing an unauthenticated POST request to inject malicious Python bytecode or shell commands directly into the execution queue.

The Impact

The impact of this vulnerability cannot be overstated. An attacker with network access to the Marimo instance (often hosted on port 2718) can:

- Execute `os.system()` or `subprocess.run()` commands.
- Establish a reverse shell to a remote Command and Control (C2) server.
- Exfiltrate sensitive data, including environment variables, API keys, and local datasets.
- Pivot within the internal network from the compromised container or VM.

How HookProbe Defends Against CVE-2026-39987

HookProbe utilizes a multi-layer threat detection strategy (L2 to L7) to monitor and validate every interaction within your environment. By deploying HookProbe agents alongside your Marimo instances, you gain visibility into the exact moment an exploit attempt occurs.

1. AEGIS: Layer 7 Command Injection Detection

The AEGIS engine is HookProbe's primary defense against application-layer attacks. It inspects HTTP/HTTPS traffic for patterns indicative of SQL injection, XSS, and, crucially, command injection.

For CVE-2026-39987, AEGIS monitors the /api/kernel/instantiate and WebSocket streams. When it detects suspicious payloads—such as encoded shell strings, curl | bash patterns, or unexpected Python imports like pty or socket—it triggers an immediate alert and can be configured to drop the connection.

2. NAPSE: Behavioral Anomaly Detection

While AEGIS looks at the payload, NAPSE looks at the behavior. NAPSE uses machine learning to establish a baseline of normal Marimo operations. If a Marimo kernel suddenly attempts to initiate an outbound connection to an unknown IP on port 4444 (a common reverse shell port), NAPSE identifies this as a high-severity anomaly.

3. HYDRA: Deep Packet Inspection (DPI)

HYDRA operates at the network level, performing deep packet inspection to identify exploit signatures. HYDRA is particularly effective at catching the initial handshake of the exploit where the attacker bypasses the authorization headers.

Technical Implementation: HookProbe Detection Rules

To protect your Marimo deployment, you can implement the following detection rules within the HookProbe console. These rules leverage the power of our DSM validation to ensure that only legitimate, authenticated traffic reaches your kernel.

AEGIS Rule Configuration

This rule targets the specific URI and looks for common RCE patterns within the JSON body of the request.

# HookProbe AEGIS Policy: Marimo-RCE-Prevention
- rule_id: HP-2026-39987-01
  name: "Detect Marimo Pre-Auth RCE Attempt"
  severity: CRITICAL
  condition:
    http.path: "/api/kernel/instantiate"
    http.method: "POST"
    payload_contains: 
      - "import os"
      - "subprocess.Popen"
      - "/bin/sh"
      - "base64.b64decode"
  action: BLOCK
  log: "Unauthenticated RCE attempt detected on Marimo kernel endpoint."

NAPSE Behavioral Monitoring

Configure NAPSE to monitor for unexpected child processes spawned by the marimo process. Typically, Marimo should only spawn Python sub-processes related to data processing.

# HookProbe NAPSE Behavioral Rule
- behavior_id: MARIMO_SHELL_SPAWN
  process_name: "marimo"
  unexpected_child: ["/bin/bash", "/bin/sh", "nc", "ncat"]
  threshold: 1
  action: QUARANTINE_NODE

For more detailed configuration options, visit our documentation portal.

The HookProbe Advantage: DSM Validation

Unlike traditional WAFs that operate in isolation, HookProbe utilizes DSM Validation. This means that every HookProbe agent participates in a mesh consensus. If an agent at the edge of your network detects a signature associated with CVE-2026-39987, that intelligence is instantly shared across the entire mesh. This "collective defense" ensures that even if an attacker tries to rotate their IP or modify their payload slightly, the rest of your infrastructure is already primed to block them.

  Capability
  Description
  Role in CVE-2026-39987 Mitigation




  **TER Generation**
  Temporal Event Records
  Provides a forensic audit trail of the exact microsecond the RCE was attempted.


  **L7 Inspection**
  Deep Application Analysis
  Identifies malicious Python bytecode hidden in WebSocket frames.


  **Mesh Participation**
  Collective Intelligence
  Blocks the attacker across all Marimo instances globally within the mesh.

Steps to Secure Your Marimo Environment

- **Update Marimo:** Immediately update your Marimo installation to version 0.10.x or higher, where the patch for CVE-2026-39987 has been applied.
- **Enable Authentication:** Ensure that `--token` or `--password` flags are used when starting the Marimo server.
- **Deploy HookProbe:** Install the HookProbe agent on the host or as a sidecar in your Kubernetes pod.
- **Activate AEGIS:** Enable the L7 protection suite to monitor the Marimo API endpoints.

For enterprise-grade protection and 24/7 monitoring, check out our pricing plans to find the right fit for your security needs.

Frequently Asked Questions

What makes CVE-2026-39987 different from other notebook vulnerabilities?

Unlike many Jupyter vulnerabilities that require an authenticated user to run malicious code, CVE-2026-39987 is a pre-authorization flaw. This means an attacker doesn't need credentials to exploit the system; they simply need network visibility to the server.

Can HookProbe detect the exploit if it's over HTTPS?

Yes. HookProbe AEGIS can be configured with SSL/TLS termination or via eBPF-based inspection to analyze encrypted traffic without compromising performance, allowing it to see the malicious payloads within HTTPS requests.

Does HookProbe impact the performance of my Python notebooks?

HookProbe is designed for minimal footprint. Our agents use highly optimized C++ and eBPF probes that add negligible latency to your applications, ensuring your data science workflows remain fast and responsive.

Conclusion

CVE-2026-39987 is a stark reminder that even modern, developer-friendly tools like Marimo are susceptible to critical security flaws. By leveraging HookProbe’s multi-layered detection capabilities—from L7 command injection filtering in AEGIS to behavioral analysis in NAPSE—organizations can protect their sensitive data and compute resources from unauthenticated RCE attacks. Stay ahead of the threat curve by integrating HookProbe into your security stack today.

For more information on securing your modern applications, visit docs.hookprobe.com.

---

Originally published at hookprobe.com. HookProbe is an open-source AI-native IDS that runs on a Raspberry Pi.

GitHub: github.com/hookprobe/hookprobe