Marimo notebook /terminal/ws pre-auth RCE exploitation (CVE-2026-39987)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects HTTP requests targeting the /terminal/ws endpoint of a Marimo notebook application, which indicates an attempt to exploit CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability involving WebSocket connections.