Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Excerpt
A threat actor exploited a pre-authentication remote code execution flaw in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in eight seconds. Tracked as CVE-2026-39987, the vulnerability affects marimo versions through 0.20.4. The flaw stems from missing authentication on /terminal/ws , exposing an interactive PTY shell to remote clients able to connect. Marimo version 0.23.0 fixes the issue by adding…
Read the original report →Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-39987 | Medium | Score 59/100 | First seen |
IOC Relationship Graph
Building graph…