Sysdig Reports LLM-Driven Container Escape and Kubernetes Secret Access
Summary
Sysdig TRT says an agentic actor exploited CVE-2026-39987 in a marimo notebook, used a mounted Docker socket to access the host, and replayed a Kubernetes service-account token to read Secrets in the default namespace.
Key points
- Sysdig TRT says it observed the activity on May 29, 2026, after exploitation of CVE-2026-39987 in a marimo notebook.
- The actor enumerated container escape options, then used a mounted Docker socket to create privileged containers and access the host filesystem.
- Sysdig says the actor accessed host credential files, including /etc/shadow and SSH keys, and used nsenter to enter host namespaces.
- The actor replayed a Kubernetes service-account token and read Secrets in the default namespace, including database credentials and API keys.
- Sysdig identified scripted payload staging, response parsing, and adaptive probing as evidence of an LLM-driven operation.
- Sysdig recommends updating marimo to version 0.23.0 or later, avoiding Docker socket mounts, restricting container privileges, and limiting service-account permissions.
Article Details
- Attack Vectors
- The attacker exploited CVE-2026-39987 in an exposed marimo notebook to gain application-level access.
- A mounted /var/run/docker.sock was used to create privileged containers with host filesystem and namespace access.
- The attacker used nsenter to enter host namespaces and access host files.
- The attacker read a mounted Kubernetes service-account token and replayed it against the in-cluster API to enumerate and dump Secrets.
- Defensive Notes
- Update marimo to version 0.23.0 or later.
- Do not mount /var/run/docker.sock into application containers.
- Run containers unprivileged with a read-only root filesystem, dropped capabilities, and a restrictive seccomp profile.
- Scope Kubernetes service-account tokens, disable automounting when unnecessary, use bound short-TTL tokens, and restrict RBAC permissions to list and get Secrets.
- Rotate credentials reachable from the compromised workload or host, including Kubernetes Secrets, AWS keys, SSH keys, and database passwords.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]43[.]71[.]95 | Reported as the source IP for the marimo exploitation and downstream replay; the article characterizes it as a moderate-quality indicator. |
| IPV4 | 43[.]167[.]11[.]88 | Reported second-stage infrastructure used to deliver the escape payload; the article characterizes source IPs as moderate-quality indicators. |
| URL | hxxp[:]//43[.]167[.]11[.]88:8084/slt | Second-stage payload URL retrieved and piped to a shell during the host breakout. |
MITRE ATT&CK
T1003.008 · /etc/passwd and /etc/shadowThe attacker directly accessed the host's /etc/shadow file through the breakout container.T1059.004 · Unix ShellThe attacker executed the retrieved second-stage payload through a shell and ran shell commands during host access.T1059.006 · PythonThe attacker delivered and executed a Python script to query the Kubernetes API and dump Secrets.T1190 · Exploit Public-Facing ApplicationThe attacker exploited CVE-2026-39987 in an exposed marimo notebook for initial access.T1528 · Steal Application Access TokenThe attacker read the Kubernetes service-account token mounted in the application pod.T1550.001 · Application Access TokenThe attacker replayed the stolen service-account token to authenticate to the in-cluster Kubernetes API.T1552.001 · Credentials In FilesAfter breakout, the attacker read host credential files, including SSH keys and /etc/shadow.T1609 · Container Administration CommandThe attacker sent Docker API requests through the mounted socket to create containers on the host.T1610 · Deploy ContainerThe attacker created privileged containers to run host commands and access host-mounted paths.T1611 · Escape to HostThe attacker used a mounted Docker socket to create privileged containers and escape to the host.T1611.001The attacker used /var/run/docker.sock to control the Docker daemon and create the breakout container.T1611.002The attacker used nsenter to enter host mount, UTS, network, PID, and IPC namespaces.T1613 · Container and Resource DiscoveryThe attacker enumerated the container environment, including the Docker socket, capabilities, seccomp posture, and Kubernetes token availability.
CVE
Products
DockerThe operation used a mounted Docker socket, nsenter, and Kubernetes service-account replay to dump host credentials and the cluster Secret store.KubernetesSysdig TRT observed an agentic threat actor exploiting CVE-2026-39987 in a marimo notebook to automate container escape, host breakout, and Kubernetes secret theft without human interaction.MarimoSysdig TRT observed an agentic threat actor exploiting CVE-2026-39987 in a marimo notebook to automate container escape, host breakout, and Kubernetes secret theft without human interaction.