CVE-2026-70615 — boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines in…
Published: 2026-08-05 · CVSS: 8.5 · CVSS 4.0
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7