A newline injection flaw in boringproxy through version 0.10.0 lets an authenticated low-privileged user write arbitrary entries into the server account's SSH authorized_keys file, which on a typical deployment escalates to persistent shell access on the host.
What Is It
CVE-2026-70615 is a CRLF/newline injection vulnerability (CWE-93) in boringproxy. The tunnel creation endpoint accepts a domain parameter without properly handling percent-encoded newline characters. Because that value is written into the server account's SSH authorized_keys file, an attacker who supplies an encoded newline can break out of the intended line and inject an arbitrary additional line; including an unrestricted public key entry of their choosing.
The only prerequisite is an authenticated account holding tunnel-creation permission. No user interaction is required, and the attack is carried out over the network.
Why It Matters
The likely outcome is a straight path from a low-privileged application account to shell on the underlying host; though whether the injected key actually yields a login depends on host configuration that the advisory does not enumerate. The account running boringproxy must permit public-key authentication, have a usable login shell, and read the authorized_keys file the injection writes to; hardened deployments that disable key auth for that account, run it as a no-login service user, or place the file outside the SSH daemon's configured path would blunt or break the chain. Operators should verify their own SSH configuration rather than assume either outcome.
Where the chain does complete, the follow-on impact is significant. The researcher write-up reports that the boringproxy database file stores credentials in cleartext, so an attacker with shell access could read all user tokens, tunnel private keys, and TLS certificates; meaning a single compromised low-privileged account would yield control of every tunnel the server brokers, plus the key material needed to impersonate it. That cleartext-storage detail comes from the researcher's repository and has not been independently confirmed in the NVD record or the vendor's own documentation; treat it as credible but unverified until you have checked your own installation.
VulnCheck assigns a CVSS v3.1 base score of 9.9 (CRITICAL): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with the changed scope reflecting the jump from the application into the host account. Their CVSS v4.0 scoring rates it 8.5 (HIGH), with high subsequent-system confidentiality, integrity, and availability impact.
The record does not appear in the CISA KEV catalog, and no exploit maturity is defined in the NVD data; there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor/Product: boringproxy (github.com/boringproxy/boringproxy)
- Affected versions: all versions up to and including 0.10.0 (
pkg:github/boringproxy/boringproxy) - No CPE entries have been published for this record yet.
Patch Status
The NVD record was published 2026-08-05 and remains in Received status. No fixed version, patch reference, or vendor remediation guidance is present in the supplied data, and no required-action deadline exists since the CVE is not KEV-listed. Operators should treat every release through 0.10.0 as affected and consult the VulnCheck advisory below for current guidance.