CVE-2026-70615
CriticalCVSS 9.9Summary
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users to inject arbitrary lines into the server's authorized_keys file. Attackers can insert a public key, gaining persistent shell access and reading credentials from the database.
Risk Assessment
Risk of persistent server compromise, theft of all user tokens, tunnel private keys, and TLS certificates, potentially leading to full system compromise.
Recommendation
Update boringproxy to a version newer than 0.10.0. Restrict tunnel creation permissions to trusted users only.
Original NVD description (English source)
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.