#marimo

HTB Cohort Complete Writeup (CVE-2026-39987, CVE-2026-41651): SSRF Vhost Discovery, Marimo Pre-Auth WebSocket RCE and PackageKit Pack2TheRoot Root Escalation

Cohort is a HackTheBox Season 11 Linux machine built around a public marketing portal that quietly proxies an internal analyst workspace. The chain starts with an SSRF in the portal's source URL feature, where loopback style addresses are blocked by name but not by every equivalent representation, letting an attacker reach an internal nginx status endpoint. That endpoint discloses the upstream map, including a randomized internal vhost that fronts a Marimo notebook service bound to loopback on the box. Once the vhost is resolved locally and reached through the reverse proxy, Marimo's unauthenticated terminal WebSocket endpoint is abused through CVE-2026-39987 to get command execution as the marimo user and capture user.txt. Escalation to root abuses CVE-2026-41651, known as Pack2TheRoot, a time of check to time of use race condition in PackageKit's D-Bus transaction handling that lets an unprivileged user swap a simulated package install for a malicious one and land a SUID root shell.