Marimo Remote Code Execution via Missing Authentication (CVE-2026-39987)

let MarimoDefaults = dynamic([2718, 8080, 8000]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "marimo" or InitiatingProcessCommandLine has "marimo"
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName =~ "marimo" or FileName =~ "python" or FileName =~ "python3"
    | where ProcessCommandLine has_any ("exec", "eval", "__import__", "subprocess", "os.system", "shell=True", "Popen")
) on DeviceId
| union (
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where RemotePort in (MarimoDefaults)
    | where InitiatingProcessFileName !in~ ("marimo", "python", "python3")
    | extend Suspicious = "Unexpected process accessing Marimo port"
)
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| extend AlertDetail = "Potential CVE-2026-39987 exploitation: unauthenticated Marimo RCE"

index=* sourcetype IN ("wineventlog:security", "linux:audit", "osquery:results", "xmlwineventlog:microsoft-windows-sysmon/operational")
| eval is_marimo_proc = if(match(process_name, "(?i)marimo") OR match(cmdline, "(?i)marimo"), 1, 0)
| eval is_shell_exec = if(match(cmdline, "(?i)(subprocess|os\.system|exec|eval|Popen|shell=True|__import__)"), 1, 0)
| eval is_network_access = if(dest_port IN ("2718", "8080", "8000") AND NOT match(process_name, "(?i)(marimo|python|python3)"), 1, 0)
| where is_marimo_proc=1 AND is_shell_exec=1 OR is_network_access=1
| stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as commands values(src_ip) as source_ips by host, user, process_name
| eval alert = "CVE-2026-39987: Marimo unauthenticated RCE indicator"
| sort - count

sequence by host.id with maxspan=2m
  [process where event.type == "start"
   and (process.name like~ "marimo" or process.command_line like~ "*marimo*")]
  [process where event.type == "start"
   and process.parent.name like~ "python*"
   and process.command_line like~ ("*subprocess*", "*os.system*", "*exec(*", "*eval(*", "*Popen*", "*shell=True*")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time, sourceip, destinationip, destinationport, username, 'CVE-2026-39987' as cve_id, QIDNAME(qid) as event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('LinuxAuth', 'MicrosoftWindows', 'SyslogUDP')
AND (
  ("Process Name" IMATCHES '.*marimo.*' AND "Command" IMATCHES '.*(subprocess|os\.system|exec|eval|Popen|shell=True).*')
  OR (destinationport IN (2718, 8080, 8000) AND "Process Name" NOT IMATCHES '.*(marimo|python|python3).*')
)
LAST 24 HOURS

_sourceCategory=*endpoint* OR _sourceCategory=*sysmon* OR _sourceCategory=*linux*
| where (process_name matches /(?i)marimo/ OR cmdline matches /(?i)marimo/)
| where cmdline matches /(?i)(subprocess|os\.system|exec\(|eval\(|Popen|shell=True|__import__)/
| count by host, user, process_name, cmdline
| fields host, user, process_name, cmdline, _count
| sort by _count desc

rule CVE_2026_39987_Marimo_RCE {
  meta:
    author = "df00tech detection engineering"
    description = "Detects potential exploitation of CVE-2026-39987 Marimo unauthenticated RCE"
    severity = "CRITICAL"
    priority = "HIGH"
  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e1.principal.process.command_line, `(?i)(marimo)`)
    $e2.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e2.principal.process.command_line, `(?i)(subprocess\.run|os\.system|eval\(|exec\(|Popen|shell=True|__import__)`)
    $e1.principal.hostname = $e2.principal.hostname
    $e2.metadata.event_timestamp.seconds > $e1.metadata.event_timestamp.seconds
    $e2.metadata.event_timestamp.seconds < $e1.metadata.event_timestamp.seconds + 120
  condition:
    $e1 and $e2
}

event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2")
| search FileName="python" OR FileName="python3" OR CommandLine=~"marimo"
| eval is_marimo_parent = if(match(ParentBaseFileName, "(?i)marimo"), 1, 0)
| eval is_rce_pattern = if(match(CommandLine, "(?i)(subprocess|os\.system|exec\(|eval\(|Popen|shell=True|__import__|pty\.spawn)"), 1, 0)
| where is_marimo_parent=1 AND is_rce_pattern=1
| stats count by ComputerName, UserName, FileName, CommandLine, ParentBaseFileName
| eval ThreatLabel = "CVE-2026-39987 Marimo Unauthenticated RCE"