CVE-2026-70615 boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation
Authenticated users can inject SSH keys via newline injection in tunnel creation, gaining shell access and reading sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-70615?
CVE-2026-70615 is a high-severity command injection vulnerability in boringproxy, published on 5 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates.
Weakness: CWE-93
Which versions are affected by CVE-2026-70615?
How do I fix CVE-2026-70615?
No fix has been published for CVE-2026-70615 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-70615 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-70615 exists.
Sources
Also known as GHSA-85pm-3999-r2fw.