{"id":"CVE-2026-124603","kind":"vulnerability","aliases":["CVE-2026-124603"],"related":[],"title":"GV-Cloud Android app: hardcoded API key can be extracted from the package","description":"An API key is\nhardcoded and retrievable from the GV-Cloud application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","summary":"The GV-Cloud Android application ships with an API key embedded in its package, so anyone who decompiles the app can read it. An attacker who extracts the key may be able to use it to make unauthorized API calls.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","gv-cloud","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:49+00:00","updated_at":"2026-11-10T01:28:49+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GV-Cloud Android app: hardcoded API key can be extracted from the package","impact":"medium","summary":"The GV-Cloud Android application ships with an API key embedded in its package, so anyone who decompiles the app can read it. An attacker who extracts the key may be able to use it to make unauthorized API calls.","audience":"businesses","category":"other","nicknames":[],"who_cares":["android","gv-cloud"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker extracts API key and misuses backend services","analyst_note":"Identify affected GV-Cloud Android versions, what the embedded key authorizes, and whether the vendor has rotated the key or released a fix; check the NVD entry for CVSS details.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that deploy or rely on the GV-Cloud Android application and the API its key authenticates against. The sources do not name the affected versions or the exact API the key grants access to.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000665,"input_tokens":4522,"output_tokens":425,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124603':17A,20A '-2026':16A,19A 'abl':57B 'allow':97C 'android':4A,21B,29B,81C 'anyon':41B 'api':7A,34B,64B,67C,89C 'app':5A,45B 'applic':30B,78C,82C,95C 'attack':50B 'call':65B 'client':94C 'cloud':3A,24B,28B,77C 'credenti':90C 'cve':15A,18A 'decompil':43B 'direct':91C 'embed':36B,87C 'engin':86C 'extract':11A,52B,101C 'gv':2A,23B,27B,76C 'gv-cloud':1A,22B,26B,75C 'hardcod':6A,70C 'key':8A,35B,54B,68C,105C 'make':62B 'may':55B,96C 'misus':103C 'packag':14A,39B,79C 'read':47B 'retriev':72C 'revers':85C 'sensit':88C 'ship':31B 'sinc':80C 'unauthor':63B,98C 'use':59B 'user':99C","nicknames":[],"mitigations":[],"who_affected":"Organizations that deploy or rely on the GV-Cloud Android application and the API its key authenticates against. The sources do not name the affected versions or the exact API the key grants access to.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","gvcloud","medium","other"],"campaign_type":null,"search_a":"'-124603':17A,20A '-2026':16A,19A 'android':4A 'api':7A 'app':5A 'cloud':3A 'cve':15A,18A 'extract':11A 'gv':2A 'gv-cloud':1A 'hardcod':6A 'key':8A 'packag':14A","search_b":"'abl':57B 'android':21B,29B 'anyon':41B 'api':34B,64B 'app':45B 'applic':30B 'attack':50B 'call':65B 'cloud':24B,28B 'decompil':43B 'embed':36B 'extract':52B 'gv':23B,27B 'gv-cloud':22B,26B 'key':35B,54B 'make':62B 'may':55B 'packag':39B 'read':47B 'ship':31B 'unauthor':63B 'use':59B","search_c":"'allow':97C 'android':81C 'api':67C,89C 'applic':78C,82C,95C 'client':94C 'cloud':77C 'credenti':90C 'direct':91C 'embed':87C 'engin':86C 'extract':101C 'gv':76C 'gv-cloud':75C 'hardcod':70C 'key':68C,105C 'may':96C 'misus':103C 'packag':79C 'retriev':72C 'revers':85C 'sensit':88C 'sinc':80C 'unauthor':98C 'user':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124603","severity":null,"published_at":"2026-11-10T01:17:18+00:00","modified_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}