CVE-2026-70615

CRITICAL 9.9

boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.

CWE	CWE-93
Vendor	boringproxy
Product	boringproxy
Published	Aug 5, 2026
Last Updated	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for boringproxy boringproxy

Be the first to know when new critical vulnerabilities affecting boringproxy boringproxy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

boringproxy / boringproxy

0 ≤ 0.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/theopaid/Remote-Code-Execution-And-Privilege-Escalation-Through-SSH-Authorized-Keys-Injection-boringproxy-/blob/master/README.md vulncheck.com: https://www.vulncheck.com/advisories/boringproxy-ssh-authorized-keys-injection-via-tunnel-creation

Credits

Theodosis Paidakis