{"id":"CVE-2026-124599","kind":"vulnerability","aliases":["CVE-2026-124599"],"related":[],"title":"Android app ships RSA private key inside its package file","description":"The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.","summary":"An Android application package contains an RSA private key and public key, so anyone who extracts the app can read them. An attacker could use the key to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other"],"not_affected_if":["hardware-keystore","keys-kept-server-side"],"how_to_check":"- Unpack the APK and search the contents for private key material, for example by grepping for `BEGIN PRIVATE KEY` or `BEGIN RSA PRIVATE KEY`.","fix":null,"status":"open","published_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:53+00:00","updated_at":"2026-11-10T01:28:53+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android app ships RSA private key inside its package file","impact":"medium","summary":"An Android application package contains an RSA private key and public key, so anyone who extracts the app can read them. An attacker could use the key to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker recovers private key and impersonates the app","analyst_note":"Identify which Android application this CVE covers at https://nvd.nist.gov/vuln/detail/CVE-2026-124599 and confirm affected versions and any vendor fix.","how_to_check":"- Unpack the APK and search the contents for private key material, for example by grepping for `BEGIN PRIVATE KEY` or `BEGIN RSA PRIVATE KEY`.\n- unknown for the affected app name and versions, as the sources do not name a product.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["keys-kept-server-side","hardware-keystore"],"who_is_affected":"Any Android app that embeds an RSA private key in its package can have that key extracted by reverse engineering, so the risk sits with the app's developer rather than the phone user. The sources name no specific product or version, so teams should check their own Android apps for bundled private keys. Apps that keep keys in a server or hardware-backed keystore are not exposed by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4565,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124599':13A,16A '-2026':12A,15A 'allow':95C 'android':1A,17B,20B,77C 'anyon':32B 'app':2A,36B,49B 'applic':21B,74C,78C,93C,109C 'attack':41B,97C 'client':92C 'contain':23B 'could':42B 'cryptograph':56B,60C,87C,116C 'cve':11A,14A 'data':52B,112C 'decrypt':50B,110C 'direct':89C 'embed':71C 'engin':84C 'extract':34B,81C 'file':10A 'generat':114C 'imperson':47B,107C 'includ':63C 'insid':7A,90C 'key':6A,27B,30B,45B,61C,66C,69C,88C,101C 'materi':62C 'may':94C 'mobil':18B 'oper':57B,117C 'packag':9A,22B,75C 'perform':54B 'potenti':103C 'privat':5A,26B,65C,86C 'protect':51B,111C 'public':29B,68C 'read':38B 'recov':99C 'revers':83C 'rsa':4A,25B,59C 'ship':3A 'store':85C 'unauthor':55B,115C 'use':43B,104C 'within':72C","nicknames":[],"mitigations":[],"who_affected":"Any Android app that embeds an RSA private key in its package can have that key extracted by reverse engineering, so the risk sits with the app's developer rather than the phone user. The sources name no specific product or version, so teams should check their own Android apps for bundled private keys. Apps that keep keys in a server or hardware-backed keystore are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","medium","mobile","other"],"campaign_type":null,"search_a":"'-124599':13A,16A '-2026':12A,15A 'android':1A 'app':2A 'cve':11A,14A 'file':10A 'insid':7A 'key':6A 'packag':9A 'privat':5A 'rsa':4A 'ship':3A","search_b":"'android':17B,20B 'anyon':32B 'app':36B,49B 'applic':21B 'attack':41B 'contain':23B 'could':42B 'cryptograph':56B 'data':52B 'decrypt':50B 'extract':34B 'imperson':47B 'key':27B,30B,45B 'mobil':18B 'oper':57B 'packag':22B 'perform':54B 'privat':26B 'protect':51B 'public':29B 'read':38B 'rsa':25B 'unauthor':55B 'use':43B","search_c":"'allow':95C 'android':77C 'applic':74C,78C,93C,109C 'attack':97C 'client':92C 'cryptograph':60C,87C,116C 'data':112C 'decrypt':110C 'direct':89C 'embed':71C 'engin':84C 'extract':81C 'generat':114C 'imperson':107C 'includ':63C 'insid':90C 'key':61C,66C,69C,88C,101C 'materi':62C 'may':94C 'oper':117C 'packag':75C 'potenti':103C 'privat':65C,86C 'protect':111C 'public':68C 'recov':99C 'revers':83C 'rsa':59C 'store':85C 'unauthor':115C 'use':104C 'within':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124599","severity":null,"published_at":"2026-11-10T01:17:18+00:00","modified_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}