---
id: "CVE-2026-124599"
page: "https://infrastack.ai/live/CVE-2026-124599"
kind: "vulnerability"
aliases: ["CVE-2026-124599"]
title: "Android app ships RSA private key inside its package file"
severity: "medium"
cvss: 6.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mobile", "other"]
not_affected_if: ["hardware-keystore", "keys-kept-server-side"]
published_at: "2026-11-10T01:17:18+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:28:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124599", "first_seen_at": "2026-11-10T01:26:41+00:00"}]
exploit_sources: []
---

# Android app ships RSA private key inside its package file

Link for people: https://infrastack.ai/live/CVE-2026-124599 (this .md is for agents)

An Android application package contains an RSA private key and public key, so anyone who extracts the app can read them. An attacker could use the key to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Unpack the APK and search the contents for private key material, for example by grepping for `BEGIN PRIVATE KEY` or `BEGIN RSA PRIVATE KEY`.

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124599

## From the sources

The RSA cryptographic key material, including a private key and public key, is
embedded within the application package. Because Android applications can
be extracted and reverse engineered, storing private cryptographic keys
directly inside the client application may allow an attacker to recover the
keys and potentially use them to impersonate the application, decrypt protected
data, or generate unauthorized cryptographic operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_