CVE-2026-70615 Details

A newline injection vulnerability has been identified in boringproxy versions through 0.10.0. This vulnerability allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file. By supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint, attackers can insert an unrestricted public key entry into authorized_keys. This exploitation grants persistent shell access, allowing the attacker to read cleartext credentials from the database file, including all user tokens, tunnel private keys, and TLS certificates.

Validate the domain parameter as a hostname before it is used, restricting it to letters, digits, dots, and hyphens. Reject or strip newline characters before the domain is added to the authorized_keys file. As an additional measure, consider writing tunnel keys to a separate file or using an AuthorizedKeysCommand to avoid modifying the main authorized_keys file.