Case marimo-rce-nkabuse-hugging-faceAI supply chainWorldwide
Marimo notebook RCE (CVE-2026-39987) exploited in hours; NKAbuse RAT staged on Hugging Face Spaces
An unauthenticated terminal WebSocket in marimo before 0.23.0 gave shell access; Sysdig saw credential theft under 10 hours after disclosure and a campaign using a typosquatted Hugging Face Space to drop a new NKAbuse variant.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 16, 2026
- Location
- Worldwide
- Target
- Marimo Python notebook servers
- Severity
- Critical
- Triggered by
- Multiple actors incl. Germany- and Hong Kong-based operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- CVE-2026-39987
What happened
An unauthenticated terminal WebSocket in marimo before 0.23.0 gave shell access; Sysdig saw credential theft under 10 hours after disclosure and a campaign using a typosquatted Hugging Face Space to drop a new NKAbuse variant.
Impact: Shell access to exposed notebooks; attackers dumped database credentials, enumerated PostgreSQL and Redis session tokens and installed a RAT with systemd, cron or LaunchAgent persistence
Who triggered it
Actor: Multiple actors incl. Germany- and Hong Kong-based operators
Attribution: Sysdig observed distinct operators: one testing 15 reverse-shell techniques and dumping PostgreSQL credentials, another using stolen .env data against Redis; NKAbuse campaign unattributed
Motive: Credential theft, data dumping and remote access
How it happened
Attack vector: Connection to /terminal/ws without authentication to open a PTY shell, then curl of a dropper hosted on a Hugging Face Space named to mimic VS Code
Root cause: Terminal WebSocket endpoint skipped the authentication check used by other endpoints
Timeline
- CVE-2026-39987 published; fixed in marimo 0.23.0
- Credential theft attacks begin less than 10 hours after technical details appear
- Campaign abusing Hugging Face Spaces to host NKAbuse begins
- CISA adds the CVE to the KEV catalog
Response
Upgrade to 0.23.0 or block the /terminal/ws endpoint; Sysdig published IOCs
Current status: Patched
Sources (open in a new tab)
- CISA KEV cisa.gov
- marimo advisory github.com
- BleepingComputer bleepingcomputer.com
Cite this case
Marimo notebook RCE (CVE-2026-39987) exploited in hours; NKAbuse RAT staged on Hugging Face Spaces. AI Threat Watch, case marimo-rce-nkabuse-hugging-face, Apr 16, 2026. https://aithreat.io/cases/marimo-rce-nkabuse-hugging-face/
Permanent link: https://aithreat.io/cases/marimo-rce-nkabuse-hugging-face/