---
id: "CVE-2026-124604"
page: "https://infrastack.ai/live/CVE-2026-124604"
kind: "vulnerability"
aliases: ["CVE-2026-124604"]
title: "GV-Cloud Android app: embedded RSA private key lets attackers impersonate it"
severity: "medium"
cvss: 6.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "gv-cloud", "mobile", "other"]
not_affected_if: ["app-not-installed"]
published_at: "2026-11-10T01:17:19+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:28:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124604", "first_seen_at": "2026-11-10T01:26:41+00:00"}]
exploit_sources: []
---

# GV-Cloud Android app: embedded RSA private key lets attackers impersonate it

Link for people: https://infrastack.ai/live/CVE-2026-124604 (this .md is for agents)

The GV-Cloud Android application package contains an RSA private and public key pair. An attacker who extracts and reverse engineers the app can recover the private key and use it to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124604

## From the sources

The RSA cryptographic key
material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_