Critical Vulnerability in boringproxy <= 0.10.0: Newline Injection Threat
An early warning has been issued regarding a critical vulnerability in boringproxy versions up to and including 0.10.0. This vulnerability reportedly allows authenticated low-privileged users to inject arbitrary lines into the server account's SSH authorized_keys file, potentially leading to unauthorized persistent shell access and credential theft.
What happened
The vulnerability, tracked as CVE-2026-70615, is under investigation. It appears to affect boringproxy (npm) versions up to 0.10.0. The issue arises from a newline injection flaw that permits authenticated users with tunnel-creation permission to insert an unrestricted public key entry into the SSH authorized_keys file. This could allow attackers to gain persistent shell access and read cleartext credentials from the database file, including user tokens, tunnel private keys, and TLS certificates.
To assess your exposure, check if your deployment includes boringproxy version 0.10.0 or earlier. It is recommended to upgrade to a version beyond 0.10.0 as soon as possible. Additionally, review the SSH authorized_keys file for any unauthorized entries. For the most accurate and up-to-date information, consult the primary sources linked in the threat data.
How 0Day mitigates this
boringproxy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.