Sliver does not restricted traffic between Wireguard clients.
Priority MEDIUM 61CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed github.com/BishopFox/sliver (Go): 1.5.44github.com/bishopfox/sliver (Go): 1.5.44
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BishopFox | sliver | up to 1.5.43 | — | No fix listed | CNA |
| — | github.com/BishopFox/sliver (Go) | before 1.5.44 | 1.5.44 | Patch available | GHSA-q8j9-34qf-7vq7 |
| — | github.com/bishopfox/sliver (Go) | before 1.5.44 | 1.5.44 | Patch available | GHSA-q8j9-34qf-7vq7 |
- sliver VendorBishopFox Affected up to 1.5.43 Fixed in — No fix listed CNA
- github.com/BishopFox/sliver (Go) Vendor— Affected before 1.5.44 Fixed in 1.5.44 Patch available GHSA-q8j9-34qf-7vq7
- github.com/bishopfox/sliver (Go) Vendor— Affected before 1.5.44 Fixed in 1.5.44 Patch available GHSA-q8j9-34qf-7vq7
Remediation
- Fix · GHSA-q8j9-34qf-7vq7 github.com/BishopFox/sliver (Go) Fixed in 1.5.44 Advisory →
- Fix · GHSA-q8j9-34qf-7vq7 github.com/bishopfox/sliver (Go) Fixed in 1.5.44 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27093
- 2026-10-03 Alias added: GHSA-q8j9-34qf-7vq7
References
Other 5
- https://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7
- https://github.com/BishopFox/sliver/commit/8e5c5f14506d6d60ebb3362e6b9857ab1e0d76ff
- https://github.com/BishopFox/sliver/commit/9122878cbbcae543eb8210f616550382af2065fd
- https://github.com/BishopFox/sliver
- https://pkg.go.dev/vuln/GO-2025-4079
More BishopFox vulnerabilities
- TI-2025-19960 Server-Side Request Forgery (SSRF) in sliver teamserver CVSS 4.0MEDIUM 6.9
- TI-2023-17391 Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows… CVSS 3.1HIGH 8.1
- TI-2024-27463 BishopFox Sliver Authenticated Remote Code Execution CVSS 3.1HIGH 7.2
- TI-2026-65413 Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC CVSS 4.0MEDIUM 6.8
- TI-2026-26522 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface CVSS 4.0MEDIUM 5.9
- TI-2026-25389 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports CVSS 4.0MEDIUM 5.7
Sources
- CVE-2025-27093 · CVE Program
- CVE-2025-27093 · NVD
- FIRST EPSS
- GHSA-q8j9-34qf-7vq7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences