CVE-2026-34227 Details
Description
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4.
A vulnerability in the Sliver command and control framework, prior to version 1.7.4, allows an unauthenticated attacker to gain immediate and silent control over all active command and control sessions or beacons. This exploitation can be done through the operator's own browser, exfiltrating sensitive data such as SSH keys and the ntds.dit file, or causing destruction to the compromised infrastructure. The issue arises from an insecure integration with the mcp-go library, which introduces permissive Cross-Origin Resource Sharing (CORS) headers and lacks authentication for a critical interface.
Users can update to Sliver version 1.7.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm | CISA-ADP | ExploitVendor Advisory |
| https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bishopfox sliver | < 1.7.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |