CVE-2026-34227: 
vulnerability analysis and mitigation

CVE-2026-34227 is a combined missing authentication and insecure CORS vulnerability in BishopFox's Sliver command-and-control (C2) framework, titled "One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface." It affects all Sliver versions up to and including v1.7.3 (Go module github.com/bishopfox/sliver). A single click on a malicious link by a Sliver operator allows an unauthenticated attacker to silently take control of every active C2 session or beacon, enabling data exfiltration or infrastructure destruction entirely through the operator's browser. The vulnerability was published on March 30–31, 2026, and patched in v1.7.4. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, BishopFox Advisory).

The root cause is a two-part flaw classified under CWE-306 (Missing Authentication for Critical Function) and CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). The Sliver MCP server runs inside the Sliver client and binds an unauthenticated HTTP/SSE interface to localhost:8080 by default, returning a permissive Access-Control-Allow-Origin: * header on all responses. The underlying mcp-go library also fails to validate the Content-Type header, allowing attackers to craft "Simple Requests" (e.g., using text/plain) that bypass the browser's CORS preflight (OPTIONS) check entirely — making the attack reliable across all modern browsers without additional techniques. If the MCP interface is misconfigured to bind to 0.0.0.0, the vulnerability escalates from a client-side CSRF/CORS issue to direct unauthenticated remote access from any network actor. A public TypeScript PoC (poc.ts) and step-by-step reproduction instructions are available (BishopFox Advisory, PoC Repository).

Successful exploitation results in total operational compromise of the Sliver C2 infrastructure. An attacker gains unauthorized access to MCP tools including list_sessions_and_beacons, fs_ls, fs_pwd, fs_cd, fs_cat, fs_rm, fs_mv, fs_cp, fs_mkdir, fs_chmod, and fs_chown — enabling complete visibility into active sessions and beacons, covert exfiltration of sensitive files (e.g., SSH keys, ntds.dit) through existing C2 channels, and arbitrary deletion or modification of files on all compromised targets. In the 0.0.0.0 misconfiguration scenario, the attack surface expands to any actor on the network or internet, requiring no operator interaction whatsoever (BishopFox Advisory, GitHub Advisory).

1. Reconnaissance: Identify Sliver operators running the Sliver client with MCP enabled (default binding: localhost:8080). Alternatively, scan for instances misconfigured to bind on 0.0.0.0 using tools like Shodan or Masscan targeting port 8080.
2. Craft malicious page: Create a webpage hosting malicious JavaScript that issues cross-origin HTTP requests to http://localhost:8080 (or the target IP if 0.0.0.0-bound), using text/plain as the Content-Type to bypass CORS preflight checks.
3. Deliver the link: Lure a Sliver operator into clicking the malicious link via phishing, open redirect, or social engineering. No credentials or prior access are required.
4. Enumerate sessions: The malicious JavaScript calls the list_sessions_and_beacons MCP tool to enumerate all active C2 sessions and beacons silently in the background.
5. Exfiltrate data: Use fs_cat against identified sessions to read and exfiltrate sensitive files (e.g., /etc/shadow, SSH private keys, ntds.dit) through the operator's existing C2 connections.
6. Sabotage or persist: Optionally issue fs_rm commands across all active implants to destroy the operator's infrastructure, or use fs_cp/fs_mkdir to plant additional payloads on compromised targets (BishopFox Advisory, PoC Repository).

• Network: Unexpected cross-origin HTTP or SSE requests to localhost:8080 or 0.0.0.0:8080 from a browser process; outbound connections from the Sliver client machine to unknown external IPs following operator web browsing activity; HTTP requests with Content-Type: text/plain to the MCP endpoint.
• Logs: Sliver client logs showing MCP API calls (list_sessions_and_beacons, fs_cat, fs_rm, etc.) not initiated by the operator; access logs on the MCP HTTP interface showing requests originating from browser user-agent strings.
• File System: Unexpected file deletions, modifications, or new files on compromised targets consistent with fs_rm, fs_cp, or fs_mkdir MCP commands; missing beacon or implant files on target systems.
• Process: Browser process (e.g., Chrome, Firefox) making HTTP connections to 127.0.0.1:8080 or the MCP port without operator-initiated action; unusual JavaScript execution in browser developer tools network tab showing requests to the MCP interface (BishopFox Advisory).

Upgrade Sliver to version 1.7.4 or later, which patches this vulnerability (BishopFox Advisory, GitHub Advisory). As interim workarounds: disable the MCP interface if not required; ensure the MCP server is never configured to bind to 0.0.0.0 — restrict it to localhost only; implement browser security controls (e.g., browser extensions or firewall rules) to block cross-origin requests to localhost:8080; and train operators to avoid clicking unsolicited or suspicious links while running the Sliver client with MCP enabled.

The vulnerability was reported by security researcher skoveit, who also published the public PoC repository. BishopFox (the maintainer of Sliver) published the advisory under moloch-- and promptly released a patch in v1.7.4. Red Hat has also tracked the vulnerability in their security advisory database. No significant broader media coverage or notable community debate has been identified beyond the technical advisory and PoC publication (BishopFox Advisory, GitHub Advisory).