Sliver C2 MCP Server Unauthenticated CORS/Preflight Bypass (CVE-2026-34227)

Metadata

Affected Target

Summary

Sliver’s MCP server exposes an unauthenticated Server-Sent Events (SSE) interface on 127.0.0.1:8080 and responds to every request with Access-Control-Allow-Origin: *. Because the underlying mcp-go library does not validate the request’s Content-Type, a cross-origin POST sent as a CORS “simple request” (text/plain) skips the browser’s preflight OPTIONS check entirely, so no CORS block and no authentication stand between a malicious web page and the operator’s local C2 console. The PoC is a self-contained HTML/JS page that opens an EventSource connection to the MCP SSE endpoint, captures the session ID from the endpoint event, then fires a no-cors JSON-RPC tools/call request (list_sessions_and_beacons) to exfiltrate active C2 session/beacon data back through the SSE stream.

Vulnerability Details

Root Cause

The MCP server sends a wildcard Access-Control-Allow-Origin: * header and does not enforce Content-Type checks, so browsers classify the malicious cross-origin POST as a CORS-simple request and never issue a preflight OPTIONS check or block the response — combined with the SSE endpoint requiring no authentication.

Attack Vector

1. Victim (a Sliver operator) with the MCP server running locally visits an attacker-controlled web page in their browser.
2. The page opens an EventSource to http://127.0.0.1:8080/sse, which succeeds due to the permissive CORS header and lack of auth.
3. The page reads the endpoint SSE event to recover the active session ID.
4. Using that session ID, the page sends a fetch(..., {mode: 'no-cors', headers: {'Content-Type': 'text/plain'}}) POST containing a JSON-RPC tools/call request for list_sessions_and_beacons.
5. Because the request is a CORS-simple request, no preflight blocks it; the MCP server processes it and streams the result back over the already-open SSE connection, which the page’s onmessage handler captures and exfiltrates.

Impact

Any web page visited by a Sliver operator can silently enumerate and exfiltrate live C2 session/beacon data without any user interaction beyond a page visit, fully bypassing the intended access boundary of the local MCP interface.

Environment / Lab Setup

Target:   Sliver C2 server with MCP server enabled, listening on 127.0.0.1:8080
Attacker: Any modern web browser rendering poc.ts (HTML/JS) as an attacker-hosted page

Proof of Concept

PoC Script

See poc.ts in this folder (a self-contained HTML document with embedded JavaScript).

1

python3 -m http.server 8000   # then browse to http://localhost:8000/poc.ts

When loaded, the page connects to the Sliver MCP SSE endpoint, steals the session ID from the endpoint event, dispatches a cross-origin no-cors JSON-RPC call to list sessions/beacons, and displays the exfiltrated data live in the page’s debug log.

Detection & Indicators of Compromise

Signs of compromise:

• MCP server access logs showing Origin headers from unrecognized web pages/domains
• Unexplained tools/call invocations (e.g., list_sessions_and_beacons) not issued by the operator’s own client
• Browser history/extensions showing visits to unfamiliar pages coinciding with MCP server activity

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/skoveit/CVE-2026-34227 on 2026-07-05.