CVE-2026-70615

This CVE is a newline injection in boringproxy's tunnel creation endpoint that achieves critical severity through a compound failure. The domain parameter accepts percent-encoded newlines (%0a), which bypass frontend validation and write directly to /home/boringproxy/.ssh/authorized_keys. This grants persistent passwordless SSH as the boringproxy service account. The 9.9 CVSS is justified not by the injection alone, but by what comes after: boringproxy stores user tokens, tunnel private keys, and TLS certificates in cleartext SQLite by default. From the initial SSH foothold, the attacker reads the database and obtains credentials for every tunnel user on the system. This transforms a single unauthorized key insertion into complete lateral movement across all provisioned tunnels. The remediation question is whether stripping newlines is sufficient, or whether the design assumption itself is flawed. The API exposes authorized_keys mutation as a first-class tunnel management primitive—the developer didn't need to overcome friction to write user input to that file; the dangerous path was the default path. Patching with a regex that removes %0a fixes the symptom while leaving the API's fundamental structure intact. If you run boringproxy: verify the patch (stripping %0a/%0d from domain input) is applied, then audit the boringproxy service account's file permissions—the application should not have write access to any system-level files outside its designated cage. Consider isolating the service account with its own homedir, applying AppArmor or seccomp to confine the process, and encrypting the SQLite database at rest. The injection is the door; the cleartext storage is what makes the breach catastrophic.

Reviewed through automated stages and approved by a human before publication.