Sliver One-Click Remote Access: असुरक्षित CORS & अनधिकृत MCP इंटरफ़ेस

The impact of CVE-2026-34227 is exceptionally severe. An attacker can silently take over every active Sliver C2 session, effectively gaining complete control over the compromised infrastructure. This includes the ability to exfiltrate sensitive data such as SSH keys and ntds.dit files, or completely destroy the environment. The attack vector is remarkably simple – a single malicious link clicked in the operator's browser is all it takes to compromise the entire system. This bypasses authentication entirely, making it a highly effective and dangerous attack.

Organizations using Sliver for penetration testing or red teaming activities are particularly at risk. Those with shared Sliver deployments or those who allow operators to use personal browsers for Sliver management are also at increased risk due to the ease of exploitation via malicious links.

• linux / server: Monitor Sliver logs for unusual activity or unauthorized session creations. Use journalctl -u sliver to review logs for suspicious patterns.

journalctl -u sliver -f | grep -i "session created" 

• generic web: Monitor web traffic for requests containing malicious URLs that could trigger the vulnerability. Use curl to inspect the response of potentially malicious links.

curl -I <malicious_url>

• go: Examine Sliver binaries for modifications or suspicious code. Use go build -gcflags="-m" sliver to see memory allocation patterns.

1. 2026-03-31Disclosure

   disclosure

1. आरक्षित2026-03-26
2. प्रकाशित2026-03-31
3. संशोधित2026-04-01
4. EPSS अद्यतन2026-04-08

The primary mitigation for CVE-2026-34227 is to immediately upgrade Sliver to version 1.7.4 or later. If upgrading is not immediately feasible, consider isolating vulnerable Sliver instances from external networks to prevent exposure to malicious links. While a direct workaround is unavailable, implementing strict browser security policies and user awareness training to prevent clicking suspicious links can reduce the risk. After upgrading, verify the fix by attempting to trigger a session takeover with a known malicious link – it should fail.