CVE-2025-61667: Datadog Agent Privilege Escalation Flaw

CVE-2025-61667 Overview

CVE-2025-61667 is a local privilege escalation vulnerability affecting the Datadog Linux Host Agent. The flaw stems from insecure permissions on the /opt/datadog-agent/python-scripts/__pycache__ directory created during installation. Datadog Linux Host Agent versions 7.65.0 through 7.70.2 are affected. Version 7.71.0 contains the patch.

A local attacker with a low-privilege account can modify Python bytecode files in this directory. The Agent executes this code during install and upgrade operations, which run as root. When an administrator triggers an upgrade, the attacker-controlled code executes with elevated privileges. The vulnerability maps to [CWE-276: Incorrect Default Permissions].

Critical Impact
Local attackers with a valid low-privilege account can achieve root-level code execution the next time the Datadog Agent is upgraded.

Affected Products

Datadog Linux Host Agent 7.65.0 through 7.70.2
Not affected: container, Kubernetes, and Windows Host Agent variants
Fixed in Datadog Agent 7.71.0

Discovery Timeline

2025-11-12 - CVE-2025-61667 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61667

Vulnerability Analysis

The Datadog Agent installer creates the /opt/datadog-agent/python-scripts/__pycache__ directory with permissions that allow non-privileged users to write to it. Python stores compiled bytecode (.pyc files) in this cache directory. During Agent installation or upgrade, the installer executes Python scripts from /opt/datadog-agent/python-scripts/, and the Python runtime loads cached bytecode from __pycache__ when available.

An attacker with local shell access and a low-privilege account can replace or modify .pyc files in this directory. Because the upgrade process runs as root, the injected bytecode executes with root privileges when the Agent is next upgraded. The attack does not require any Agent misconfiguration beyond the default install state on affected versions.

Root Cause

The root cause is insufficient directory permissions applied during package installation. The __pycache__ directory should be writable only by the dd-agent service user or root, but affected versions grant broader write access. This violates the principle of least privilege for filesystem objects executed by a privileged process.

Attack Vector

Exploitation requires local access and a valid low-privilege account on the host. The attacker writes a malicious .pyc bytecode file to /opt/datadog-agent/python-scripts/__pycache__, matching the name of a legitimate cached module. The payload executes when an administrator or automation system runs an Agent install or upgrade. User interaction (an admin-initiated upgrade) is required, which is reflected in the CVSS vector.

No verified public exploit code is available. See the Datadog GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2025-61667

Indicators of Compromise

Unexpected file modifications in /opt/datadog-agent/python-scripts/__pycache__/ by non-root, non-dd-agent users
Presence of .pyc files with recent modification timestamps not aligned with an Agent upgrade window
Root-owned processes spawned from Python during Agent upgrade that execute unexpected commands (shell, network activity, credential access)

Detection Strategies

Audit filesystem permissions on /opt/datadog-agent/python-scripts/__pycache__ and alert when the directory is world-writable or group-writable by non-privileged groups
Monitor Linux audit framework (auditd) write events on the __pycache__ directory, filtering for non-root, non-dd-agent UIDs
Correlate Datadog Agent upgrade events with unusual child process activity under the Agent installer

Monitoring Recommendations

Enable file integrity monitoring on /opt/datadog-agent/python-scripts/ and its subdirectories
Log and review all Datadog Agent install and upgrade events centrally, including exit codes and spawned processes
Alert on any privilege escalation chain that originates from the datadog-agent install path

How to Mitigate CVE-2025-61667

Immediate Actions Required

Upgrade the Datadog Linux Host Agent to version 7.71.0 or later on all affected hosts
Before upgrading, inspect /opt/datadog-agent/python-scripts/__pycache__ for unauthorized .pyc files and remove any suspicious content
Restrict interactive local access on hosts running the Datadog Agent to trusted administrators

Patch Information

Datadog released the fix in Agent version 7.71.0. Refer to the GitHub Security Advisory GHSA-6852-76c5-6cmg for the full advisory. Only the Linux Host Agent is affected; container, Kubernetes, and Windows Host Agents do not require this patch.

Workarounds

Manually tighten permissions on /opt/datadog-agent/python-scripts/__pycache__ so that only root and the dd-agent user can write to it
Remove and regenerate the __pycache__ directory prior to any Agent upgrade if the patched version cannot be deployed immediately
Enforce least-privilege on shared Linux hosts to reduce the pool of accounts able to abuse the writable directory

bash

# Restrict permissions on the vulnerable cache directory
sudo chown -R root:dd-agent /opt/datadog-agent/python-scripts/__pycache__
sudo chmod 750 /opt/datadog-agent/python-scripts/__pycache__
sudo find /opt/datadog-agent/python-scripts/__pycache__ -type f -exec chmod 640 {} \;

# Verify Agent version after upgrade
datadog-agent version