{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34227", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-26T16:22:29.033Z", "datePublished": "2026-03-31T15:25:32.224Z", "dateUpdated": "2026-04-01T14:04:12.835Z"}, "containers": {"cna": {"title": "Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm"}], "affected": [{"vendor": "BishopFox", "product": "sliver", "versions": [{"version": "< 1.7.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T15:25:32.224Z"}, "descriptions": [{"lang": "en", "value": "Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4."}], "source": {"advisory": "GHSA-6fpf-248c-m7wm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T14:04:07.996780Z", "id": "CVE-2026-34227", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T14:04:12.835Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34227", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T14:04:07.996780Z"}}}], "references": [{"url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T14:04:03.179Z"}}], "cna": {"title": "Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface", "source": {"advisory": "GHSA-6fpf-248c-m7wm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "BishopFox", "product": "sliver", "versions": [{"status": "affected", "version": "< 1.7.4"}]}], "references": [{"url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm", "name": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T15:25:32.224Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34227", "state": "PUBLISHED", "dateUpdated": "2026-04-01T14:04:12.835Z", "dateReserved": "2026-03-26T16:22:29.033Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T15:25:32.224Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4."}], "id": "CVE-2026-34227", "lastModified": "2026-04-01T14:24:02.583", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-31T16:16:32.440", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-6fpf-248c-m7wm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sliver", "source": "cna", "vendor": "BishopFox"}, "product": "sliver", "vendor": "bishopfox"}], "analysis": {"en": {"generated_at": "2026-03-31T17:25:28.041516+00:00", "value": {"mitigation_remediation": ["Upgrade Sliver to version 1.7.4 or later to remove the insecure CORS settings and enforce authentication on the MCP interface.", "If a patch is not yet available, restrict web access to the MCP endpoint by applying strict CORS policies or limiting traffic to trusted IP ranges.", "Disable unauthenticated access to the MCP interface and require credential verification before granting session control.", "Verify that no instances of Sliver older than 1.7.4 are running on the network; perform an inventory of all host versions.", "Monitor browser activity for attempts to trigger malicious links and alert security teams to suspicious access patterns."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated remote control leading to data exfiltration and infrastructure destruction"}, "threat_synthesis": {"affected_systems": "Sliver, a command and control platform developed by BishopFox, is impacted in all releases prior to 1.7.4. The custom Wireguard netstack and MCP interface in those versions allow unauthorized users to gain control of every beacon from a web browser. Version 1.7.4 contains the patch that removes the insecure CORS configuration and authenticates MCP access.", "description_and_impact": "The vulnerability arises from insecure CORS rules and an unauthenticated MCP interface in the Sliver C2 framework, allowing a single click on a malicious link to grant an attacker silent, privileged control of all active sessions. The attacker can then exfiltrate sensitive data such as SSH keys and Ntds.dit files or even destroy the entire compromised environment. This flaw is the result of an authentication bypass (CWE\u2011306) combined with unrestricted control over managed sessions (CWE\u2011942).", "risk_and_exploitability": "With a CVSS score of 5.9 the flaw carries medium severity, and its exploitability is not quantified by EPSS data. Because the attack can be performed by simply clicking a link in a browser, it is easy to replicate without prior knowledge or credentials. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread exposure to compromised sessions makes immediate remediation critical."}}}}, "created": "2026-03-31T19:54:09.848163+00:00", "updated": "2026-03-31T20:38:05.827581+00:00", "vendors": ["bishopfox", "bishopfox$PRODUCT$sliver"]}