boringproxy through version 0.10.0 contains a critical newline injection vulnerability in its tunnel creation endpoint. Authenticated low-privileged users with tunnel-creation permissions can exploit this flaw by supplying a percent-encoded newline character in the domain parameter. This allows attackers to inject arbitrary lines into the server's SSH authorized_keys file, enabling insertion of unauthorized public keys. Successful exploitation grants persistent shell access to the server. Furthermore, attackers can subsequently read cleartext credentials from the database file, exposing all user tokens, tunnel private keys, and TLS certificates. The vulnerability represents a significant privilege escalation and credential theft risk for any deployment of the affected software.