CVE-2026-70615: boringproxy Privilege Escalation Flaw

CVE-2026-70615 Overview

CVE-2026-70615 is a newline injection vulnerability in boringproxy through version 0.10.0. Authenticated low-privileged users with tunnel-creation permission can inject arbitrary lines into the server account's SSH authorized_keys file. The flaw resides in the tunnel creation endpoint, where the domain parameter accepts a percent-encoded newline character. Attackers append an unrestricted public key entry, gain persistent shell access to the host, and read cleartext credentials from the database file, including user tokens, tunnel private keys, and TLS certificates.

Critical Impact
A low-privileged authenticated attacker can escalate to a persistent interactive shell on the boringproxy host and exfiltrate all stored credentials, tokens, and private keys.

Affected Products

boringproxy through version 0.10.0
Deployments exposing the tunnel creation endpoint to authenticated users
Any host running boringproxy where the server account owns ~/.ssh/authorized_keys

Discovery Timeline

2026-08-05 - CVE-2026-70615 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70615

Vulnerability Analysis

boringproxy manages tunnel routing by writing SSH public keys into the server account's authorized_keys file. When a low-privileged user submits a tunnel creation request, the application incorporates the user-supplied domain parameter into the key entry without stripping CRLF sequences. This is a CRLF injection flaw classified under CWE-93: Improper Neutralization of CRLF Sequences.

Because OpenSSH treats each line of authorized_keys as an independent key directive, an injected newline followed by an attacker-controlled public key produces a fully valid, unrestricted key entry. The attacker then authenticates over SSH with the matching private key and obtains an interactive shell as the boringproxy service account.

Once shell access is established, the boringproxy SQLite database file is world-readable to the service user. The attacker extracts every stored user token, per-tunnel SSH private key, and TLS certificate, enabling complete takeover of proxied services and impersonation of the tenant infrastructure.

Root Cause

The tunnel creation handler URL-decodes the domain parameter and concatenates it into a template line written to authorized_keys. No validation rejects %0A (newline) or %0D (carriage return) bytes in the decoded value, so a single request writes multiple lines to the key file.

Attack Vector

Exploitation requires an authenticated account with permission to create tunnels. The attacker sends an HTTP request to the tunnel creation endpoint with a domain parameter containing a percent-encoded newline followed by a chosen SSH public key entry. After the server writes the injected key, the attacker connects to the host over SSH using the corresponding private key. Public technical details are available in the VulnCheck Security Advisory and the GitHub PoC Repository.

Detection Methods for CVE-2026-70615

Indicators of Compromise

Unexpected public key entries appended to the boringproxy service account's ~/.ssh/authorized_keys file.
SSH login events for the boringproxy service account from IP addresses not associated with administrators.
HTTP requests to the tunnel creation endpoint containing %0A or %0D inside the domain parameter.
Reads or copies of the boringproxy SQLite database file outside normal service activity.

Detection Strategies

Alert on any modification to authorized_keys on hosts running boringproxy, correlating changes to tunnel creation API activity.
Inspect reverse proxy and application access logs for percent-encoded CR or LF bytes in tunnel-related parameters.
Baseline the number of authorized keys for the service account and alert on additions.

Monitoring Recommendations

Forward host authentication logs and boringproxy application logs to a central analytics platform for correlation.
Monitor process execution under the boringproxy service account for interactive shells, sqlite3, and outbound file transfer utilities.
Track network egress from the boringproxy host to detect credential exfiltration following an injection attempt.

How to Mitigate CVE-2026-70615

Immediate Actions Required

Restrict tunnel creation permission to trusted administrators until a fixed release is deployed.
Audit authorized_keys on every boringproxy host and remove entries that were not provisioned by an administrator.
Rotate all boringproxy user tokens, tunnel SSH keys, and TLS certificates stored in the database, since they must be considered compromised on affected hosts.
Restrict inbound SSH to the boringproxy host to known administrator source addresses.

Patch Information

No fixed release is referenced in the published advisory data at the time of writing. Track the VulnCheck Security Advisory for updates and upgrade guidance once a patched version is published.

Workarounds

Reject tunnel creation requests whose domain parameter contains newline, carriage return, or their percent-encoded forms at a reverse proxy or WAF in front of boringproxy.
Run boringproxy under a dedicated system account whose authorized_keys file is owned by root and made immutable using chattr +i where operationally acceptable.
Move the SQLite database file to a directory not readable by the service account and require elevated privileges for legitimate access paths.

bash

# Configuration example: block CRLF in the domain parameter at nginx
location /api/tunnels {
    if ($request_uri ~* "domain=[^&]*(%0A|%0D|%0a|%0d)") {
        return 400;
    }
    proxy_pass http://boringproxy_upstream;
}

# Make authorized_keys immutable after provisioning
sudo chattr +i /home/boringproxy/.ssh/authorized_keys