CISA’s April 23, 2026 update to its Known Exploited Vulnerabilities Catalog is a reminder that the most dangerous security problems are often the ones attackers have already operationalized. This time, the spotlight falls on CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo, an open-source notebook tool used by data scientists and developers. The flaw carries a CVSS score of 9.8, placing it in the critical severity range.

What is Marimo and Why Should You Care?

Marimo is a reactive Python notebook that has gained popularity for its reproducibility and ease of use. Unlike Jupyter notebooks, Marimo runs entirely in the browser and can be deployed as a web application. This makes it a prime target for attackers: a single vulnerable instance can expose an entire organization’s data science pipeline. CVE-2026-39987 affects all Marimo versions prior to 1.12.1, which was released on March 18, 2026.

The Vulnerability: Pre-Auth RCE

The vulnerability resides in the notebook execution endpoint. An attacker can send a specially crafted HTTP request to the Marimo server without any authentication. Successful exploitation allows arbitrary code execution on the underlying server. Given that Marimo is often deployed in internal networks with access to sensitive datasets, the impact is severe. The flaw was discovered by security researchers at Project Discovery and responsibly disclosed to the Marimo team.

CISA’s Directive: Act Now

CISA’s KEV catalog inclusion means that federal agencies must remediate this vulnerability by May 13, 2026, per Binding Operational Directive 22-01. While the directive applies to U.S. federal civilian agencies, it sets a de facto standard for all organizations. CISA has not yet released technical details of active exploitation, but the catalog entry confirms that attacks are underway.

Mitigation Steps

  1. Update immediately: Upgrade to Marimo 1.12.1 or later. The fix is available on GitHub and PyPI.
  2. Network segmentation: Ensure Marimo instances are not exposed to the internet unless absolutely necessary. Use VPNs or reverse proxies with authentication.
  3. Monitor logs: Look for unusual HTTP requests targeting the /api/run endpoint.
  4. Apply WAF rules: If a web application firewall is in place, block requests with suspicious payloads in the request body.

Broader Implications

This is the second Marimo vulnerability added to CISA KEV in 2026. The previous one, CVE-2026-21012, was a stored XSS flaw. The pattern suggests that Marimo is under active scrutiny by threat actors. Organizations using Marimo should treat it as a critical component in their attack surface and apply patches promptly.

Conclusion

CVE-2026-39987 is a textbook example of why pre-auth RCE vulnerabilities are the most dangerous. They require no user interaction and can be exploited at scale. CISA’s KEV update is a clear signal: patch now, or risk being the next headline. The May 13 deadline is not a suggestion—it’s a mandate for federal agencies and a best practice for everyone else.