Sysdig details rapid Marimo exploit path to AWS-backed SSH access

Sysdig reported that a threat actor exploited CVE-2026-39987, a pre-authenticated remote-code-execution flaw in Marimo, then reached an SSH bastion host in eight seconds. The reported chain used credentials harvested from the compromised instance to call AWS Secrets Manager, retrieve a private key and authenticate to the bastion. Sysdig said the flaw affects all Marimo versions and entered active exploitation within hours of public disclosure. The operator issued more than 850 commands during a nine-hour session, according to the report.