Agent

Version 2.1.0

Released November 8, 2026

Security

Option to block changes to PreUp, PostUp, PreDown, and PostDown WireGuard scripts from the C2 (these scripts allow arbitrary shell commands to be run as root). To enable this option, (block changes to scripts) add the following environment variable to the agent:
```
CRUX_ALLOW_PRE_POST_SCRIPTS=false
```
The default value for this environment variable currently is true; we intend to change the default value to false for the July 2027 release.

Added

Support for C2 batch enrollment.
Support for SKA-P registration with client credentials.
New --reinstall option for Linux install.sh to re-install clean version of all the agent's Python libraries, as well as its service scripts.
CycloneDX SBOM now published with release.

Changed

Upgraded to Arqit SKA-Platform™ Python SDK version 26.06.
Python 3.10 is now the minimum required version of Python.
Linux install.sh automatically installs and uses Python 3.14 on RHEL 9 and derivatives if still using Python 3.9.
Linux install.sh now prompts to re-install the agent's Python libraries if run with a newer version of Python than originally installed with (for example, after the OS has been upgraded to a new major release).
Linux install.sh now prompts to remove tunnels, deregister, and delete all agent config files when run with the --remove option.

Fixed

Avoid Files in use dialog during agent upgrade on Windows by first stopping Crux tunnels and tray before starting upgrade.
Include MSVCP140.dll & VCRUNTIME140.dll on the path of the Windows tunnel service; on systems without these DLLs installed by other software the tunnel would fail to start with a generic message like:
```
The service did not respond to the start control request in a timely fashion.
```
Maintain calculated IPv4/IPv6 preference when reloading config file.
Fix boolean coercion for read_only_cnf config property.
Log "request registration config..." only after agent setup.
Log fatal exceptions in Windows service to main log once the main Python logging system has been initialized.
Fixed container image to install agent into /opt/crux-agent/ instead of /opt/venvs/crux-agent/.
Fixed container image README to provide correct package-list command.

Version 2.0.4

Released October 21, 2026

Security

This release resolves the following vulnerability:

Compromised eMudhra CA certificate: Starting with release 2.0.0, the Crux agent uses the operating system's trust store to validate the TLS certificates of the Crux C2 and SKA-Platform servers when it connects to them over HTTPS; so therefore, to distrust the compromised eMudhra CA certificate with the standard Linux or Windows version of the agent, you should update the host operating system's trust store (and then restart the agent service).

When run inside a Docker container, however, the agent uses the container image's trust store; the standard agent container image is based on Alpine Linux, which included the compromised CA cert in its trust store from summer 2025 to 20 Oct 2026. The 2.0.4 release of the Crux agent includes a new container image with the updated Alpine Linux trust store, which no longer trusts the compromised CA cert.

Prior to release 2.0.0, all versions of the Crux agent used a trust store bundled with the agent, in the certifi Python package. To distrust the compromised eMudhra CA certificate with those versions of the agent, manually edit the certifi package's trust store, remove the compromised eMudhra CA certificate from it, and then restart the agent service.

On Linux, prior to 2.0.0, the agent's certifi trust store was at /opt/venvs/cruxvpn-agent/lib/python*/site-packages/certifi/cacert.pem. On Windows, the agent's certifi trust store was located at C:\Program Files\Sirius Computer\Crux VPN Agent\lib\certifi\cacert.pem.

This file can be opened with any text editor; search for the string emSign ECC Root CA - C3 inside the file to find the compromised certificate, and delete the certificate block immediately following that string, beginning with and including the -----BEGIN CERTIFICATE----- line, and ending with and including the next -----END CERTIFICATE----- line.

Separately from the HTTPS requests made by the Crux agent, on Linux the agent relies on the Python Pip package manager to update the Python packages that comprise the agent. Pip itself should be updated to distrust the compromised eMudhra CA certificate. Run the following command for the Linux agent 2.0.0 or newer to upgrade its copy of Pip:
```
sudo /opt/crux-agent/bin/pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
```
For Crux agent releases prior to 2.0.0, run this command to upgrade Pip:
```
sudo /opt/venvs/cruxvpn-agent/bin/pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
```

Version 2.0.3

Released October 9, 2026

Security

This release resolves the following vulnerability:

Severity	CVE Identifier	Published	Updated	Exploitability	Mitigating Factors
Medium	CVE-2026-107785	October 9, 2026	October 9, 2026	Low	Only affects agents using `SHA-512` for SKA peering

CVE-2026-107785: With agent versions 1.9.0 through 2.0.2, if the initiator of SKA peering was configured to use the SHA-512 hash function for peering (instead of the default SHA-256 hash function), the agent would fail to apply the secret keys derived from SKA peering to its running Crux tunnels. When this happened, the only indication of a problem would be a cryptic "Found trailing character in key file" warning message written to the agent's local log output.

Furthermore, if the organization's "Enforce SKA Use" setting was set to "No", and the agent was configured to use the SHA-512 hash function before its first start-up, the agent would start up with useable Crux tunnels, but no SKA-derived secret keys would ever be applied to the tunnels (and therefore the tunnels would not be quantum safe).

This version of the agent is fixed to correctly apply secret keys from SKA peering, regardless of the SKA peering hash function selected. Alternatively, this issue can be fixed by removing any custom "Hash Function" settings applied in the C2 web UI (see the Agent Configuration docs for details).

Changed

Removed deprecated secret parameter from API setup request.

Fixed

Fixed logging initialization to include SKA log entries when a custom logging configuration file is used.
Fixed openSUSE Leap 16 install error where the install script would not automatically find the default system Python path.

Fixed Rocky Linux 8 install error due to needing the expat package installed. The error printed by the install script is:

Error: Command '['/opt/crux-agent/bin/python3', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

Running /opt/crux-agent/bin/python3 -m ensurepip will further reveal this specific error:

ImportError: /usr/lib64/python3.12/lib-dynload/pyexpat.cpython-312-x86_64-linux-gnu.so: undefined symbol: XML_SetBillionLaughsAttackProtectionMaximumAmplification

Version 2.0.2

Released July 29, 2026

Fixed

Fixed tray start-up failure on Windows 11. Resulted in a dialog box with a stack trace that ends with following error:
```
AttributeError: 'NoneType' object has no attribute 'split'
```

Version 2.0.1

Released July 27, 2026

Fixed

Fixed tunnel start-up failure on Ubuntu 25.04 and newer. Resulted in error message like the following in the crux-wg@crux0 service log:
```
/usr/bin/wg-quick: line 40: /etc/crux/crux0.conf: Permission denied
```

Version 2.0.0

Released July 20, 2026

Added

Windows UI via system tray icon. Icon shows status of Crux tunnels. Right-click icon to show more detailed information, and to start and stop tunnels.
Windows installer option to automatically copy a downloaded setup file to the Crux configuration directory.
Linux env vars file at /etc/default/crux-agent.
NOTICE file in release packages with information about each bundled third-party library and its license.

Changed

Rebranded from Crux VPN to just Crux, renaming all files, directories, and services that previously had cruxvpn in their names to crux; plus some additional name changes detailed below. The Windows installer and Linux install script will automatically make all necessary name changes when upgrading from 1.x to 2.x. Docker upgrades need to follow steps in the Docker 2.0 Upgrade documentation.
WireGuard tunnel and driver now bundled with the agent on Windows (no longer need to separately install WireGuard for Windows).
Now uses the system trust store by default (instead of the bundled Certifi trust store) to verify TLS certificates (except on Python 3.9, which still uses Certifi). New CRUX_CA_BUNDLE environment variable allows specifying an alternate CA bundle, via one of the following values:
- system (default): System trust store.
- certifi: Certifi trust store.
- Path to CA cert bundle file (eg /etc/ssl/cert.pem).

Fixed

Fixed install script to install the required libsodium package on openSUSE Leap 16.

Renaming Crux VPN to Just Crux

Following are the principal name changes on each platform; see the Upgrade the Agent platform-specific documentation for full details:

All platforms:
- Agent config file name changed from cruxvpn.conf to crux-agent.conf
- Agent credentials file name changed from cruxvpn-credentials.conf to crux-credentials.conf
- Agent setup file name changed from cruxvpn-setup.conf to crux-setup.conf
- SKA-P registration file name changed from cruxvpn-registration.conf to crux-registration.conf
- Main binary file name changed from cruxvpn-agent to crux-agent
- SKA-P registration binary file name changed from cruxvpn-register to crux-register
- Environment variable prefix changed from CRUXVPN_* to CRUX_*
Docker only:
- Image name changed from ghcr.io/siriuscomputer/cruxvpn-agent to ghcr.io/siriuscomputer/crux-agent-ska
- Image config directory changed from /etc/cruxvpn/ to /etc/crux/
Linux only:
- Agent service name changed from cruxvpn-agent to crux-agent
- Tunnel service name changed from cruxvpn-wg@crux0 to crux-wg@crux0
- Config directory changed from /etc/cruxvpn/ to /etc/crux/
- Root program directory changed from /opt/venvs/cruxvpn-agent/ to /opt/crux-agent/
Windows only:
- Agent service name changed from cruxvpn-agent-service to crux-agent-service
- Tunnel service name changed from WireGuardTunnel$crux0 to CruxTunnel$crux0
- Agent config directory changed from C:\Program Files\Sirius Computer\Crux VPN Agent\cnf\ to C:\ProgramData\Crux\cnf\
- Tunnel config directory changed from C:\Program Files\WireGuard\Data\configurations\ to C:\ProgramData\Crux\cnf\
- Log directory changed from C:\Program Files\Sirius Computer\Crux VPN Agent\log\ to C:\ProgramData\Crux\log\
- Root program directory changed from C:\Program Files\Sirius Computer\Crux VPN Agent\ to C:\Program Files\Crux\

Version 1.18.0

Released April 19, 2026

Added

Added Windows code signing to MSI package (as well as to all EXE, DLL, and PS1 scripts in the MSI package).
Added Sigstore signatures to artifact downloads.
Added "inbound" and "all" options to MSS clamping script.

Changed

Upgraded to Arqit SKA-Platform™ SDK version 26.01.
Upgraded other dependencies to latest versions (that still support Python 3.9).
Individual SKA API endpoint settings (such as UserAuth, Dscc, etc) have been completed replaced by Domain and Use TLS settings (configurable via SKA-Platform admin page in Crux web UI).

Fixed

Fixed a potential race condition when deleting empty deviceMetadata.json files, now deleting them only when more than 2 minutes old. Failed SKA-P device registration can create an empty deviceMetadata.json file; but this file may also be emptied temporarily by the backround SKA authentication thread.
Prevent connectivity-check pings from keeping a tunnel active when no other traffic has been sent through it for more than 2 minutes.
Allow agent to start up in reduced-functionality mode when SKA libs are missing.

Version 1.17.0

Released March 4, 2026

Added

Collect connectivity issues and send them to Crux API.
New connectivity checks for individual WireGuard peers, including attempting to send traffic through connections with a recent WireGuard handshake (disable by setting CheckWgPeerPingTimeout = 0 in the agent config).
Collect host inventory properties and send them to Crux API.
Send SKA DUID to Crux API.

Changed

Now exponentially backs off Crux API requests after encountering 4 consecutive error responses, up to the point of 1 request every 1-2 hours (downside is it may take an hour or two for an agent to start communicating with the Crux API again after a connectivity issue has been fixed). This back-off does not apply to communication with SKA API or peers.
Changed the formatting of connectivity checks on agent start.
Changed systemd service to not drop CAP_NET_RAW capability, allowing the agent to make true ICMP ping requests.
No longer tries to de-register & re-register with SKA-P on terminal authentication failure; instead propagates error as connectivity issue to Crux API, allowing Crux API to factory-reset device (if so configured).
Handle device-policy verification errors by deleting devicePolicy.json config file (which should be replaced on next device-policy update).

Version 1.16.1

Released February 1, 2026

Changed

During agent set-up, config settings from cruxvpn-setup.conf now override any settings from an existing cruxvpn.conf file (but settings not overridden by cruxvpn-setup.conf are preserved).
Allow set-up process to run even when ReadOnly = true setting in agent config.
More logging for Crux API calls.

Version 1.16.0

Released January 17, 2026

Changed

Agent now pulls its own configuration from Crux API by default, overwriting manual cruxvpn.conf settings (see Agent Configuration documentation for details).
Agent now pulls SKA-P registration settings from Crux API if available and cruxvpn-registration.conf not supplied (see SKA-P Registration documentation for details).
Agent now can use use single cruxvpn-setup.conf file for set-up.

Version 1.15.1

Released December 9, 2025

Fixed

Fixed Linux install script download of pre-built liboqs when using older versions of curl; previously would error with this message:
```
curl: option --no-clobber: is unknown
```

Version 1.15.0

This release fixes a DNS-resolution issue that will prevent the agent from working properly with its default DNS settings after December 15, due to an incompatibility between its previously default DNS resolver (Quad9, aka 9.9.9.9) and the way it resolves DNS by default (using DNS-over-HTTPS, aka DoH, with HTTP 1.1).

Released December 7, 2025

Added

Ability to re-provision device after SKA Device Recovery action is invoked.

Changed

Made host system's own DNS resolver the default; new default is the same as this cruxvpn.conf setting:
```
[Cruxvpn]
Dns = off
```
Updated default settings to use new SKA version 25.9 URLs and PaaS region as default; new defaults are the same as these cruxvpn.conf settings:
```
[SKA]
Region = ska
Domain = ska.quantum.cloud
[SKA.API]
UserAuth = https://api.ska.quantum.cloud
```
Updated default settings for SKA update intervals; new defaults are the same as these cruxvpn.conf settings (intervals in seconds):
```
[SKA]
HeartbeatInterval = 120
DevicePropertiesInterval = 3600
DevicePolicyInterval = 600
```
Enabled cruxvpn.conf file to use [SKA] and [SKA.API] sections, and enabled cruxvpn-registration.conf file to use [SKA.Registration] section, in place of PQC prefixed sections (but PQC sections will still work as before for the time being).
Renamed SKA-related modules and logging to use "ska" identifier in place of "pqc".

Fixed

Fixed DNS errors querying default DNS server after December 15.
Fixed initiators to not wait until next scheduled interval to agree on new keys after re-registration.

Version 1.14.0

Released November 11, 2025

Changed

Upgraded Arqit SDK to version 25.12-alpha1.
Python 3.9 is now the minimum required version of Python.

Fixed

Fixed documentation URLs in logging and help files.

Version 1.13.2

Released November 3, 2025

Fixed

Avoid skipping some changes when multiple queued changes are applied at the same time.
Avoid breaking the tunnel for queued changes that include/require a restart of the interface.

Version 1.13.1

Released October 24, 2025

Changed

Changed canonical OCI image name from ghcr.io/crux-comms/cruxvpn-agent to ghcr.io/siriuscomputer/cruxvpn-agent.
Disabled cosign build signing temporarily (until other infrastructure pieces are moved into place).

Version 1.13.0

Released October 19, 2025

Changed

Break the tunnel to a device when it is quarantined, de-registered, or removed from all security groups in common (when belonging to an organization that requires a common security group to agree on a key).
Optionally break the tunnel to a device when the time since its last symmetric key rotation exceeds the configured max TTL.
Save keys agreed with unknown SKA-P devices.
Upon learning a WireGuard peer is a SKA-P device, either apply its saved key, or generate a dummy key to prevent the tunnel to it from being used until the first secret key is agreed.
Start initiating symmetric key agreements right after SKA-P registration, instead of waiting 90 seconds for device UIDs to propagate.
Pause SKA initiators in a 25-second "blackout" window around the expected WireGuard handshake.
Enable a "rotate now" command from the web UI to force immediate symmetric key rotation.

Version 1.12.1

Released September 26, 2025

Fixed

Fixed missing log output on Windows.
Avoid doing client-side DNS resolution for API calls when using an HTTP proxy.

Version 1.12.0

Released August 1, 2025

Changed

Change the agent's core monitoring logic to:
1. Ignore interfaces outside of the configured WireGuard directory (previously would report on all WireGuard interfaces)
2. Report on down interfaces (previously would ignore them)
Flip IPv6/IPv4 preference if connectivity check to API fails, and try it with the other address family.
Run DNS queries to secondary DNS servers in parallel, if primary takes too long to respond.
If custom DNS servers specified, query them with UDP by default (unless the URL or hostname with which they can be queried with DoH is also specified via the Doh setting; or unless the DNS servers are from well-known DoH providers).

Fixed

Fixed ReadOnly setting to block changes from being applied on client.

Version 1.11.2

Released July 25, 2025

Changed

Send custom application name, version, and developer name to device properties API (eg "Crux Linux Agent 1.11.2 by Sirius").

Fixed

Don't automatically retry registration if 1st attempt fails. Now if registration fails, an administrator must correct the issue, and then manually restart the agent.
Fix registration mode to always use uppercase values (eg QKEY).
Better error messages when missing required registration config settings (such as Realm).
Fixed pre-built liboqs download logic in install.sh script to ignore minor OS versions when checking for available downloads.
Fixed install.sh to run ldconfig only if a library path was added.
Don't try to load agent conf files from /etc/wireguard.
Avoid writing deviceProperties.json when no props have changed.

Version 1.11.1

Released July 6, 2025

Added

Allow custom SKA-P domain to be configured in agent conf via Domain setting, as a shorthand for setting each individual SKA-P API endpoint.
Allow QKey and QKeyId settings in agent registration conf.
Allow agent conf settings to be specified as base64; eg: PasswordBase64 = cGFzc3dvcmQgIyAxMjM=.

Fixed

Allow # characters in Password setting of agent registration conf.
Fix startup sequence to not miss DUID updates that occurred while agent was not running.

Version 1.11.0

Released June 14, 2025

Added

Connectivity checks for Arqit SKA-Platform™ (SKA-P).
"Offline" mode for non-essential SKA-P endpoints; engaged via the following /etc/cruxvpn/cruxvpn.conf settings:
```
[PQC.API]
MonitorHeartbeat = offline
MonitorProperties = offline
Policy = offline
```

Changed

Bundle Arqit SKA-Platform™ SDK into agent tarball.

Fixed

Enable communication with Crux API even when no SKA-P connectivity; and enable SKA-P peering and communication with SKA-P endpoints even when no Crux API connectivity.

Version 1.10.0

Released May 30, 2025

Added

Agent MSI builds via GitHub Actions.
Liboqs DLL builds via GitHub Actions.

Changed

Download liboqs.so if pre-built version available (rather than always build it from source) on install.
Default the location of device*.json files to the same directory as the cruxvpn.conf file (rather than always /etc/cruxvpn) if not explicitly specified.

Version 1.9.3

Released May 29, 2025

Added

"Offline" mode for interacting with the API server, where the agent will not attempt to connect to the API server if you change its /etc/cruxvpn/cruxvpn.conf Api setting to this:
```
Api = offline
```

Version 1.9.2

Released May 18, 2025

Added

Tarball and container image builds via GitHub Actions.

Fixed

Fixed agent name in crux0.conf comment.
Fixed install.sh "wg-quick service definition not found" error on Debian Buster.
Fixed liboqs build on Alpine Linux for 32-bit ARM (eg Raspberry Pi).

Version 1.9.1

Released May 8, 2025

Added

Automatically install iptables package (required for packet forwarding).

Changed

Try to install newer Python on RHEL 8 variants on clean install (RHEL 8 default is Python 3.6; Python 3.8 or newer is required).

Fixed

Clean up de-register/re-register cycle to avoid this error: No such file or directory: '/etc/cruxvpn/deviceProperties.json'

Version 1.9.0

Released May 3, 2025

Added

Use Arqit SKA-Platform™ to generate WireGuard preshared keys.
Automatically register device with SKA-Platform if not yet registered.
Automatically start SKA-Platform peering socket receiver and initiators based on settings in WireGuard config.
Build and install liboqs as part of install script.
Option to redact preshared keys only.

Changed

Use /etc/cruxvpn directory to consolidate all config files.
Define and use cruxvpn-wg systemd service in place of wg-quick service.
Improve handling of interrupt/terminate signals to shut down faster.
Use versioningit plugin to calculate agent version number.

Removed

Remove support for Python versions older than 3.8.
Remove old Windows EXE installer (deprecated by new MSI-based installer).

Fixed

Explicitly set root log level to override log settings from libraries.

Version 1.8.0

Initial Release