Crux Agent CVE-2026-107785

Exploitation of the confidentiality path requires a specific, narrow combination: the Crux C2 organization must have the 'Enforce SKA Use' setting turned OFF, and the affected peer must never have successfully negotiated a valid 32-byte bilocation key, so that no WireGuard preshared key is applied to the tunnel at all. The 64-byte key condition arises specifically when a peering session negotiates SHA-512 (producing a 64-byte key the agent fails to validate or install). Beyond these product-configuration prerequisites, the attacker must be able to intercept and durably store the peer's tunnel traffic AND must have (now or in the future) access to a cryptographically relevant quantum computer - the latter being the dominant limiting factor, as no such machine is publicly available, making this a harvest-now-decrypt-later exposure rather than an immediately realizable attack. Deployments with 'Enforce SKA Use' enabled, or peers that have already negotiated a valid 32-byte key, are not exposed to the disclosure.

This is a genuine-but-low-urgency cryptographic hygiene flaw, not an imminent threat. The CVSS 4.0 score of 6.3 (Medium) is consistent with the real-world signals: Exploit Maturity is E:U (unproven), there is no CISA KEV listing and no POC, so the correct characterization is 'no public exploit identified at time of analysis.' The attack vector is network (AV:N) and requires no privileges (PR:N), which sounds severe, but this is strongly offset by AC:H and AT:P (Attack Requirements present) - the practical prerequisites are extreme. The impact is confidentiality only (VC:H/SC:H, with VI/VA/SI/SA:N), reflecting a harvest-now-decrypt-later exposure rather than any integrity or availability compromise via the disclosure path. Crucially, decryption is predicated on the attacker possessing a cryptographically relevant quantum computer, which does not exist publicly as of this analysis - so real exploitation is a future/theoretical risk against captured traffic, not a live breach. A separate functional defect in the same CVE (64-byte SHA-512 keys silently failing to apply, tunnels failing to restart) is a reliability/availability concern but is not scored as the primary impact here. Signals are internally consistent: low maturity, high complexity, confidentiality-only, future-dated threat model. Treat as a prioritized patch for environments handling data requiring long-term secrecy, but not an emergency.

An attacker positioned on the network path between two Crux-managed peers passively intercepts and stores WireGuard tunnel traffic for a peer where no preshared key was ever applied - because the organization has 'Enforce SKA Use' disabled and the peer never negotiated a valid 32-byte bilocation key. Years later, once a cryptographically relevant quantum computer becomes available, the attacker uses it to break the tunnel's classical key exchange and decrypt the stored ciphertext, since the post-quantum protection normally provided by the WireGuard preshared key was absent. No public exploit code exists; exploitation is a future harvest-now-decrypt-later scenario, not a currently demonstrable attack.