Sysdig Traces LLM-Driven Intrusion from marimo CVE to PostgreSQL Exfiltration
Summary
Sysdig TRT reports an intrusion that began with CVE-2026-39987 in an internet-facing marimo notebook and reached an internal PostgreSQL database. It presents command-stream evidence for real-time LLM-agent execution and recommends patching and rotating exposed secrets.
Key points
- Sysdig TRT says it observed an intrusion beginning with exploitation of CVE-2026-39987 in an internet-reachable marimo notebook.
- The team reports that attackers harvested cloud credentials, retrieved an SSH private key from AWS Secrets Manager, and accessed a downstream bastion.
- Sysdig says eight SSH sessions dumped the schema and contents of an internal PostgreSQL database in under two minutes.
- Twelve AWS API calls across 11 Cloudflare Workers IPs in 22 seconds reportedly obscured source-IP correlation.
- Sysdig attributes the activity to an LLM agent based on improvised database queries, a leaked planning comment, machine-oriented command formatting, and output-driven handoffs.
- The article recommends updating marimo to 0.23.0 or later, restricting or disabling /terminal/ws if unable to update, and rotating credentials and keys accessible to exposed instances.
Article Details
- Attack Vectors
- The attacker exploited CVE-2026-39987 on an internet-reachable marimo notebook through its /terminal/ws endpoint.
- Credentials harvested from the compromised host were used to access AWS Secrets Manager and retrieve an SSH private key.
- The attacker routed AWS API requests through Cloudflare Workers and used the retrieved key for parallel SSH sessions to a bastion.
- From the bastion, the attacker queried and exfiltrated the schema and contents of an internal PostgreSQL database.
- Defensive Notes
- Update marimo to version 0.23.0 or later. If that is not possible, restrict access to /terminal/ws or disable the terminal feature.
- Audit environment variables, .env files, and secrets on publicly accessible marimo instances; rotate exposed AWS credentials, API keys, database passwords, and SSH keys.
- Maintain visibility across internal assets, enable telemetry for investigation of lateral movement, and deploy runtime threat detection and response.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]28[.]157[.]50 | Cloudflare Workers egress IP used for attacker container and SSH-key enumeration on the bastion. |
| IPV4 | 104[.]28[.]162[.]160 | Cloudflare Workers egress IP used during the attacker’s SSH-bastion activity, including PostgreSQL queries. |
| IPV4 | 104[.]28[.]165[.]169 | Cloudflare Workers egress IP used for an attacker command block searching for credentials and files on the bastion. |
| IPV4 | 104[.]28[.]165[.]251 | Cloudflare Workers egress IP used during the attacker’s SSH-bastion activity, including PostgreSQL queries. |
| IPV4 | 157[.]66[.]54[.]26 | Source IP for the observed attacker WebSocket sessions to the vulnerable marimo instance. |
MITRE ATT&CK
T1021.004 · SSHThe attacker used multiple SSH sessions to access the downstream bastion host.T1078 · Valid AccountsThe attacker used harvested cloud credentials and the retrieved SSH key to authenticate to AWS and the SSH bastion.T1083 · File and Directory DiscoveryThe attacker searched files and directories on the compromised host and bastion for credentials and SSH keys.T1190 · Exploit Public-Facing ApplicationThe attacker exploited CVE-2026-39987 against an internet-reachable marimo notebook to gain initial access.T1552.001 · Credentials In FilesThe attacker harvested credentials from files including .env files, .pgpass, and cloud credential files.T1552.004 · Private KeysThe attacker searched for and used an SSH private key retrieved from AWS Secrets Manager.T1555 · Credentials from Password StoresThe attacker retrieved an SSH-key secret from AWS Secrets Manager.
CVE
People
Products
AWS Secrets ManagerThe attack used CVE-2026-39987, AWS Secrets Manager, SSH bastion access, and Cloudflare Workers to fan out requests and evade per-source-IP detection.Cloudflare WorkersThe attack used CVE-2026-39987, AWS Secrets Manager, SSH bastion access, and Cloudflare Workers to fan out requests and evade per-source-IP detection.Marimoit has captured, where an LLM agent performed post-compromise actions in real time from a vulnerable marimo notebook to internal PostgreSQL exfiltration in under one hour.PostgreSQLLLM agent performed post-compromise actions in real time from a vulnerable marimo notebook to internal PostgreSQL exfiltration in under one hour.