CVE-2026-107785 Details
Description
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the `wg set` command to update the live tunnel, and write the invalid key to the WireGuard configuration file. The update fails, so the live tunnel keeps using its previous preshared key until the tunnel is shut down. The tunnel will fail to start when restarted. For a peer which has never successfully negotiated a 32-byte bilocation key in a Crux C2 organization which has the "Enforce SKA Use" setting turned off, no preshared key will be set for the tunnel. Therefore, an attacker who is able to intercept and store the peer's traffic, and has access (or will have access) to a cryptographically relevant quantum computer, will be able to decrypt the tunnel.
A vulnerability exists in Crux Agent versions 1.9.0 prior to 2.0.3, where the full SKA bilocation key is used as the WireGuard preshared key. This issue arises when a peering session negotiates the use of SHA-512, resulting in a 64-byte key instead of the 32 bytes required by WireGuard. The agent fails to validate the key size and instead attempts to update the live tunnel using the invalid key, which is then written to the WireGuard configuration file. This update fails, causing the tunnel to continue using the previous preshared key until it is manually shut down. Additionally, for peers that have never successfully negotiated a 32-byte bilocation key in a Crux C2 organization with the 'Enforce SKA Use' setting turned off, no preshared key will be assigned. Consequently, an attacker who can intercept and store the peer's traffic and has access to a quantum computer could decrypt the tunnel.
Users are advised to upgrade to Crux Agent version 2.0.3 or later, which truncates the SKA key to the required 32 bytes for WireGuard. As a temporary workaround, remove any custom hash function settings in the agent's configuration to revert to the default SHA-256 hash function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sirius.computer/security-disclosure-policy/ | d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-252 | Unchecked Return Value | d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132 |
| CWE-325 | Missing Cryptographic Step | d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132 |
| CWE-394 | Unexpected Status Code or Return Value | d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132 |
Affected Products
| Product | Versions |
|---|---|
| Sirius Computer Crux Agent | >= 1.9.0, <= 2.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132 |