CVE-2026-34227

A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser.

Description

The Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to localhost:8080 by default. The service returns a permissive Access-Control-Allow-Origin: * header on all responses.

Because this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator's browser, no credentials required.

If the interface is misconfigured to bind to all interfaces (0.0.0.0), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network.

Exposed Methods

Exploitation grants unauthorized access to the following MCP tools:

• list_sessions_and_beacons
• fs_ls, fs_pwd, fs_cd
• fs_cat
• fs_rm, fs_mv, fs_cp, fs_mkdir
• fs_chmod, fs_chown

PoC

1. Start the Sliver client with MCP enabled (default localhost:8080)
2. Open a browser and load a page containing the Proof of Concept JavaScript.
3. Observe that the page successfully lists sessions and can issue filesystem commands against live implants, with no authentication

Impact Assessment

Successful exploitation results in total operational compromise.

• Direct Infrastructure Exposure: If misconfigured to 0.0.0.0, the C2 framework becomes fully accessible to any actor on the network or internet without requiring operator interaction.
• Information Leakage: Complete visibility into active sessions, deployed beacons, and file system structures (list_sessions_and_beacons, fs_ls, fs_pwd).
• Arbitrary File Read: Covert exfiltration of any target data (e.g., SSH keys, ntds.dit) through the C2 channel (fs_cat).
• Integrity & Availability Loss: Arbitrary deletion or modification of files on compromised targets, leading to potential sabotage or denial of service (fs_rm, fs_mv, fs_cp).

Severity: Critical

Attack Scenarios

Scenario 1: Data Exfiltration via Drive-by Execution (Default Localhost) An operator clicks a link to a benign-looking site hosting malicious JavaScript (e.g. via open redirect). The script executes commands against localhost:8080, retrieves the operator's target list, and silently downloads sensitive files (e.g., a target's ntds.dit) using the operator's existing C2 connections.

Scenario 2: Campaign Neutralization (Default Localhost) A malicious site lures an operator to a controlled domain. Embedded JavaScript immediately issues fs_rm commands across all active implants, mass-deleting beacons and permanently severing operator access to the target network in a single click.

Scenario 3: Direct Takeover (0.0.0.0 Misconfiguration) An operator configures the MCP interface to listen on 0.0.0.0 for team access. An external attacker scans the network, discovers the exposed port, and directly issues unauthenticated API calls to hijack active sessions, drop connections, or exfiltrate data.

Technical Root Cause

The vulnerability stems from an insecure integration with the mcp-go library. While the library hardcodes permissive CORS (Access-Control-Allow-Origin: *), it also fails to validate the Content-Type header. This allows an attacker to use Simple Requests (e.g., text/plain) to bypass the browser's CORS preflight (OPTIONS) check entirely, making the attack highly reliable across all modern browsers without any additional techniques.

Furthermore, the Sliver implementation fails to implement any authentication middleware or origin restrictions to protect the sensitive RPC interface, meaning even if the CORS behavior were corrected upstream in mcp-go, the endpoint would remain fully unauthenticated.

Demo

https://github.com/user-attachments/assets/b18216c2-2c0b-41a2-aa39-229b3f148c24

A critical operation is accessible without requiring any authentication. Typical impact: any user can invoke the privileged function.

Kodem intelligence

1. What is CVE-2026-34227? CVE-2026-34227 is a medium-severity missing authentication for critical function vulnerability in github.com/bishopfox/sliver (go), affecting versions <= 1.7.3. It is fixed in 1.7.4. A critical operation is accessible without requiring any authentication.
2. Which versions of github.com/bishopfox/sliver are affected by CVE-2026-34227? github.com/bishopfox/sliver (go) versions <= 1.7.3 is affected.
3. Is there a fix for CVE-2026-34227? Yes. CVE-2026-34227 is fixed in 1.7.4. Upgrade to this version or later.
4. Is CVE-2026-34227 exploitable, and should I be worried? Whether CVE-2026-34227 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-34227 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-34227? Upgrade github.com/bishopfox/sliver to 1.7.4 or later.