2026-04-13 · 2026-Q2
Marimo Pre-Auth RCE Weaponized to Deploy NKAbuse via Hugging Face
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
Marimo Python reactive notebook platform (all versions up to 0.20.4)
Impact
662 exploit events from 11 source IPs across 10 countries between April 11 and 14, 2026; reverse shells, credential theft, DNS exfiltration, lateral movement to PostgreSQL and Redis, and deployment of a new NKAbuse variant; malware installer hosted on a typosquat Hugging Face Space "vsccode-modetx" drops a Go ELF binary named kagent that uses the NKN blockchain for C2
Root cause
/terminal/ws WebSocket endpoint lacks the validate_auth() call present on other endpoints; unauthenticated attackers obtain a full PTY shell; exploitation began within 10 hours of public disclosure
CVE
Sources
Catalog
Cite this: AgentProv incident record: Marimo Pre-Auth RCE Weaponized to Deploy NKAbuse via Hugging Face (2026-04-13). https://agentprov.com/incidents/2026-04-13-marimo-pre-auth-rce-weaponized-to-deploy-nkabuse-via-hugging-face
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run