HIGH 8.5 NVD
CVE-2026-70615
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject a
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.
References
- https://github.com/theopaid/Remote-Code-Execution-And-Privilege-Escalation-Through-SSH-Aut
- https://www.vulncheck.com/advisories/boringproxy-ssh-authorized-keys-injection-via-tunnel-
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-08-05 via NVD.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.