PatchSiren cyber security CVE debrief
CVE-2026-70615 boringproxy CVE debrief
The boringproxy service through version 0.10.0 is vulnerable to a newline injection attack. Authenticated users with low privileges and tunnel-creation permissions can inject arbitrary lines into the server account's SSH authorized_keys file. This can be achieved by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. As a result, attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access. With this access, they can subsequently read cleartext credentials from the database file, including all user tokens, tunnel private keys, and TLS certificates. Evidence is based on CVE and NVD records; further details are needed for complete impact assessment. System administrators and security teams should verify the integrity of their deployments, restrict tunnel creation permissions, and monitor for unauthorized changes to the authorized_keys file. Immediate attention is required to restrict tunnel creation permissions and verify the authorized_keys file. AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:17.420Z and has not been modified since then.
- Vendor
- boringproxy
- Product
- Unknown
- CVSS
- HIGH 8.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-05
- Original CVE updated
- 2026-08-05
- Advisory published
- 2026-08-05
- Advisory updated
- 2026-08-05
Who should care
System administrators and security teams responsible for boringproxy installations, especially those with exposed or internet-facing deployments, should be aware of this vulnerability. Immediate attention is required to restrict tunnel creation permissions and verify the authorized_keys file.
Technical summary
The boringproxy service through version 0.10.0 is vulnerable to a newline injection attack. Authenticated users with low privileges and tunnel-creation permissions can inject arbitrary lines into the server account's SSH authorized_keys file. This can be achieved by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. As a result, attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access. With this access, they can subsequently read cleartext credentials from the database file, including all user tokens, tunnel private keys, and TLS certificates.
Defensive priority
Authenticated low-privileged users with tunnel-creation permission can inject arbitrary lines into the server account's SSH authorized_keys file. Immediate attention is required to restrict tunnel creation permissions and verify the authorized_keys file.
Recommended defensive actions
- Restrict tunnel creation permissions to only necessary users and roles.
- Verify and monitor the server account's SSH authorized_keys file for unauthorized changes.
- Implement additional logging and monitoring for tunnel creation activities.
- Consider using more restrictive authentication methods for SSH connections.
- Update boringproxy to a version that fixes the vulnerability, if available.
Evidence notes
The boringproxy service through version 0.10.0 is vulnerable to a newline injection attack. Authenticated users with low privileges and tunnel-creation permissions can inject arbitrary lines into the server account's SSH authorized_keys file. This can be achieved by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. As a result, attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access. With this access, they can subsequently read cleartext credentials from the database file, including all user tokens, tunnel private keys, and TLS certificates. Evidence is based on CVE and NVD records; further details are needed for complete impact assessment.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:17.420Z and has not been modified since then.