CVE-2026-124604: Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1
The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Any party relying on the embedded RSA private key for application identity, decryption, or cryptographic authorization may be affected. An attacker can obtain the key material by extracting and reverse engineering the Android application package.
What does an attacker need to exploit the issue?
The attacker needs access to the GV-Cloud Android application package and the ability to reverse engineer it to recover the embedded key material. The provided information does not indicate that authentication, user interaction, or network access is required.
How can an organization determine whether it is affected?
Verify whether deployed clients use GV-Cloud Android Application v1.5.1 and inspect the application package for embedded RSA private and public key material. Systems that trust or use that recovered private key for cryptographic operations should be treated as potentially exposed.
What should be done if the private key may have been recovered?
Treat the embedded private key as compromised and replace it with newly generated key material where possible. Any systems, identities, or encrypted data that depend on the exposed key should be reviewed for potential impersonation, unauthorized cryptographic operations, or decryption risk.