Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
Date: 2026-03
Affected: go/github.com/bishopfox/sliver
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-34227
CWE: CWE-306
CWE-942

A single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, `ntds.dit`) or destroying the entire compromised infrastructure, entirely through the operator's own browser. ## Description The Sliver MCP server runs inside the Sliver Client and binds an unauthenticated HTTP and SSE interface to `localhost:8080` by default. The service returns a permissive `Access-Control-Allow-Origin: *` header on all responses. Because this server is client-side, the attack surface is distributed across every individual operator in the operation. Any arbitrary website can issue cross-origin requests and interact with the MCP interface via an operator's browser, no credentials required. If the interface is misconfigured to bind to all interfaces (`0.0.0.0`), the vulnerability escalates from a client-side CSRF/CORS issue to direct, unauthenticated remote access from any actor on the network. ## Exposed Methods Exploitation grants unauthorized access to the following MCP tools: - `list_sessions_and_beacons` - `fs_ls`, `fs_pwd`, `fs_cd` - `fs_cat` - `fs_rm`, `fs_mv`, `fs_cp`, `fs_mkdir` - `fs_chmod`, `fs_chown` ## PoC 1. Start the Sliver client with MCP enabled (default `localhost:8080`) 2. Open a browser and load a page containing the [Proof of Concept JavaScript](https://github.com/skoveit/CVE-2026-34227). 3. Observe that the page successfully lists se


Mitigations:

Architectural layers (MAESTRO):