---
id: "CVE-2026-124603"
page: "https://infrastack.ai/live/CVE-2026-124603"
kind: "vulnerability"
aliases: ["CVE-2026-124603"]
title: "GV-Cloud Android app: hardcoded API key can be extracted from the package"
severity: "medium"
cvss: 6.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "gv-cloud", "other"]
not_affected_if: []
published_at: "2026-11-10T01:17:18+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:28:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124603", "first_seen_at": "2026-11-10T01:26:41+00:00"}]
exploit_sources: []
---

# GV-Cloud Android app: hardcoded API key can be extracted from the package

Link for people: https://infrastack.ai/live/CVE-2026-124603 (this .md is for agents)

The GV-Cloud Android application ships with an API key embedded in its package, so anyone who decompiles the app can read it. An attacker who extracts the key may be able to use it to make unauthorized API calls.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124603

## From the sources

An API key is
hardcoded and retrievable from the GV-Cloud application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the key.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_