CVE

CVE-2026-39987

View on NVD ↗

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Exploitation IoCs 3

Domain cdnorigin[.]net
SHA-1 31c69b3e12936abca770d430066f379ec1d997ec
IP 209[.]99[.]186[.]235

MITRE ATT&CK TTPs 8

T1059.001
PowerShell
Execution
 T1078.001
Default Accounts
Defense Evasion
 T1090
Proxy
Command And Control
 T1133
External Remote Services
Persistence
 T1210
Exploitation of Remote Services
Lateral Movement
 T1220
XSL Script Processing
Defense Evasion
 T1566
Phishing
Initial Access
 T1659
Content Injection
Initial Access

Source Articles

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
A Go-based botnet named NadMesh, discovered in early July 2026, actively targets exposed AI and cloud services to harvest cloud credentials, Kubernetes tokens, and model access. The malware prioritizes exploitation of MCP (Model Context Protocol) services, Docker APIs, Jenkins consoles, and Redis instances, with a focus on credential theft rather than host compromise. The operator uses self-propagating scanning infrastructure, persistence mechanisms, and obfuscation to evade detection, while targeting specific ports associated with AI tools like ComfyUI, Ollama, Gradio, and n8n. Researchers observed real-time exploitation traffic, though success rates for MCP exploitation remain low compared to other vectors.
hacker-news Jul 17, 2026