Vulnerability Description
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/theopaid/Remote-Code-Execution-And-Privilege-Escalation-Throu
- https://www.vulncheck.com/advisories/boringproxy-ssh-authorized-keys-injection-v
FAQ
What is CVE-2026-70615?
CVE-2026-70615 is a vulnerability with a CVSS score of 9.9 (CRITICAL). boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's...
How severe is CVE-2026-70615?
CVE-2026-70615 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-70615?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.