SAML private key leak

I have encountered a data leak recently and it turns out source code got leaked.
I’m analysing everything that might come back to bite me and of the things is SAML private key.

Could a private key be used with malicious intent? I understand it gives the ability to decrypt SAML requests and the possibility to create some aswell, but I am far from knowledgable on the subject.

Thanks!

Z