Attackers exploit Marimo RCE to deploy NKAbuse variant via Hugging Face
Summary
Sysdig reports attackers exploiting Marimo CVE-2026-39987 to deploy an NKAbuse variant from Hugging Face Spaces. It recommends upgrading to Marimo 0.23.0 or blocking external access to /terminal/ws.
Key points
- Sysdig observed exploitation of Marimo's remote code execution flaw, CVE-2026-39987, less than 10 hours after technical details were disclosed.
- One campaign used a typosquatted Hugging Face Space to host a dropper and a binary named kagent.
- The dropper installs a previously undocumented NKAbuse variant, which Sysdig says can run shell commands and return their output to the operator.
- The malware sets up persistence through systemd, cron, or macOS LaunchAgent.
- Sysdig also observed attempts involving reverse shells, database credential theft, lateral movement, and Redis data access.
- Sysdig recommends upgrading to Marimo 0.23.0 or later, or blocking external access to the /terminal/ws endpoint.
Article Details
- Event Type
- Active exploitation of a remote code execution vulnerability to deploy NKAbuse malware and conduct credential and database-data theft.
- Impact
- Sysdig reported attackers exploiting CVE-2026-39987 in Marimo to run attacker-supplied code and deploy an NKAbuse variant that can execute shell commands and return output. Other observed activity included attempts to extract database credentials and access PostgreSQL and Redis data, including session tokens and application cache entries. Sysdig recommended upgrading to Marimo 0.23.0 or later, or blocking external access to /terminal/ws.
MITRE ATT&CK
T1053.003 · CronThe dropper establishes persistence using cron, according to the article.T1059.004 · Unix ShellThe NKAbuse variant can execute shell commands on infected systems, according to Sysdig.T1105 · Ingress Tool TransferAfter exploiting Marimo, an attacker used curl to download a dropper script from the attacker-created Hugging Face Space; the dropper then downloaded the kagent binary.T1543.002 · Systemd ServiceThe dropper establishes persistence using systemd, according to the article.T1547.011 · Plist ModificationThe dropper can establish persistence using a macOS LaunchAgent.
CVE
Malware
Vendors
Products
Hugging Face SpacesAttackers are exploiting a critical remote code execution flaw in the Marimo reactive Python notebook (CVE-2026-39987) to deploy a new variant of NKAbuse hosted on Hugging Face Spaces.MarimoAttackers are exploiting a critical remote code execution flaw in the Marimo reactive Python notebook (CVE-2026-39987) to deploy a new variant of NKAbuse hosted on Hugging Face Spaces.PostgreSQLThey then pivoted to lateral movement by extracting database credentials from environment variables and connecting to PostgreSQL, where they rapidly enumerated schemas, tables, and configuration data.RedisAnother actor from Hong Kong used stolen .env credentials to target a Redis server, systematically scanning all 16 databases and dumping stored data, including session tokens and application cache entries.
Countries
GermanySysdig also spotted other notable attacks exploiting CVE-2026-39987, including a Germany-based operator who attempted 15 reverse-shell techniques across multiple ports.Hong KongAnother actor from Hong Kong used stolen .env credentials to target a Redis server, systematically scanning all 16 databases and dumping stored data, including session tokens and application cache entries.