CVE-2026-70615
Received Received - Intake

Authenticated Newline Injection in boringproxy SSH authorized_keys

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70615
EUVD
EUVD-2026-53584

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
boringproxy boringproxy to 0.10.0 (inc)
boringproxy boringproxy From 0.1.0 (inc) to 0.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a newline injection vulnerability in boringproxy versions up to 0.10.0. Authenticated low-privileged users with tunnel-creation permissions can inject arbitrary lines into the server's SSH authorized_keys file by using a percent-encoded newline in the domain parameter of the tunnel creation endpoint. This allows attackers to add unrestricted public key entries, gaining persistent shell access and the ability to read sensitive credentials from the database.

Detection Guidance

Check the SSH authorized_keys file on the server running boringproxy for unexpected entries. Use commands like 'cat ~/.ssh/authorized_keys' to inspect for unauthorized public keys. Also review tunnel creation logs for requests containing percent-encoded newline characters in the domain parameter.

Impact Analysis

An attacker could gain persistent shell access to your server, steal cleartext credentials including user tokens, tunnel private keys, and TLS certificates, and escalate privileges. The attack requires only an HTTP request with a crafted domain parameter and persists even after service restarts or tunnel deletion.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of cleartext credentials, tokens, and private keys may result in data breaches, triggering compliance violations and potential regulatory penalties.

Mitigation Strategies

Upgrade boringproxy to a patched version if available. Remove unauthorized entries from the authorized_keys file immediately. Implement strict input validation for the domain parameter to block newline characters. Restrict tunnel creation permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart