CVE-2026-34227: BishopFox Sliver unauthenticated remote access in MCP interface

CVE-2026-34227 · Severity: high · CVSS 8.8 · Published 2026-03-31

Sliver is a command and control (C2) framework used by security professionals to manage simulated cyberattacks. A vulnerability in its management interface allows an attacker to take over active sessions if an operator clicks a malicious link. This could result in the theft of sensitive data like SSH keys or the complete destruction of the testing infrastructure.

Technologies: Bishopfox Sliver, github.com/bishopfox/sliver (Go). Vendors: Bishopfox, Go.

Quick answers

Is CVE-2026-34227 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34227 being exploited in the wild.
How severe is CVE-2026-34227?
High severity, with a CVSS score of 8.8, published 31 March 2026.
Which products and versions are affected?
Bishopfox Sliver < 1.7.4; github.com/bishopfox/sliver (Go) SEMVER:introduced=0,fixed=1.7.4.
Is there a fix for CVE-2026-34227?
Yes. github.com/bishopfox/sliver (Go): upgrade to 1.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34227 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34227?
Check whether you run Bishopfox Sliver or github.com/bishopfox/sliver (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/bishopfox/sliver (Go): upgrade to 1.7.4 or later
    go get github.com/bishopfox/sliver@v1.7.4

Technical details

The Sliver MCP (Multi-Client Protocol) server, which typically binds to localhost:8080, lacks authentication and implements a permissive CORS policy (Access-Control-Allow-Origin: *). Because the server fails to validate the Content-Type header, attackers can use 'Simple Requests' to bypass CORS preflight checks. An attacker can use Cross-Site Request Forgery (CSRF) via a malicious website to execute commands through the operator's browser, such as listing sessions, reading files (fs_cat), or deleting files (fs_rm). If the interface is misconfigured to bind to 0.0.0.0, it becomes directly accessible over the network without user interaction. The issue is patched in version 1.7.4.

Affected products

  • BishopFox Sliver < 1.7.4

Identifiers

  • CVE-2026-34227
  • GHSA-6fpf-248c-m7wm
  • GO-2026-5175

Timeline

  • 2026-03-30: advisory: GitHub/Vendor advisory published
  • 2026-03-31: disclosed: NVD publication date
  • 2026-03-31: patched: Fixed in version 1.7.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.