CVE-2026-70615: Boringproxy

Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days.

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.

Affected products

• Boringproxy Boringproxy: up to and including 0.10.0

Published 2026-08-05. Last modified 2026-09-24.