Loading story…
A critical vulnerability tracked as CVE-2026-70615 affects boringproxy through version 0.10.0, allowing an authenticated low-privileged user with tunnel-creation permission to inject arbitrary lines into the server account’s authorized_keys file. The flaw stems from newline injection in the tunnel creation endpoint, where a percent-encoded newline supplied in the domain parameter can be written into SSH key configuration, effectively letting an attacker add an unrestricted public key and gain persistent remote shell access.
Once shell access is established, an attacker can read cleartext secrets from the boringproxy database, including user tokens, tunnel private keys, and TLS certificates. The issue is described as remotely exploitable and carries a CVSS 3.1 score of 9.9. Recommended mitigation includes updating boringproxy, restricting tunnel creation privileges to trusted users, and reviewing and cleaning any unauthorized entries from authorized_keys files.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A critical newline injection vulnerability affecting boringproxy through version 0.10.0 was disclosed. The flaw lets an authenticated low-privileged user with tunnel-creation permission inject arbitrary lines into the server account's SSH authorized_keys file via a percent-encoded newline in the domain parameter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-32746** was disclosed in **GNU InetUtils `telnetd`** affecting version **2.7 and earlier**, enabling **pre-authentication remote code execution** through a buffer overflow in the **LINEMODE SLC handler**. The flaw stems from a missing bounds check in the `add_slc` function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as **root**, resulting in full system compromise. The issue was rated **CVSS 9.8** and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible `telnetd` instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking **TCP port 23**, or disabling Telnet entirely where it is not operationally required.
Jul 24, 2026
A critical vulnerability in ProxySQL, tracked as **CVE-2026-48772**, allows remote attackers to spoof client source IP addresses by abusing improper parsing of HAProxy PROXY protocol v1 `UNKNOWN` headers. A crafted frame with appended address fields can cause ProxySQL to trust a forged IP and use it in `mysql_query_rules.client_addr`, `stats_mysql_processlist.cli_host`, and `event_log`, enabling access-control and routing bypass as well as misleading audit trails. The issue affects ProxySQL versions **2.0.0 through 3.0.8** and is especially dangerous because `mysql-proxy_protocol_networks = '*'` is the default, exposing any reachable MySQL frontend to attempted exploitation. The flaw was reproduced in testing by sending a forged address that triggered query rules intended for a different client, demonstrating the ability to influence schema pinning, query filtering, and other IP-based controls. ProxySQL addressed the issue in **version 3.0.9**, which also fixed another critical pre-authentication memory-corruption bug, **CVE-2026-48773**. Security advisories rate CVE-2026-48772 as remotely exploitable and severe, with published scores ranging from **CVSS 9.1 to 10.0**, and urge organizations running **3.0.8 or earlier** to upgrade immediately.
Jun 29, 2026
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026