CVE-2026-39196: Vector v0.54.0 SQL Injection Vulnerability

CVE-2026-39196 Overview

CVE-2026-39196 is a SQL injection vulnerability in Datadog Vector v0.54.0, an observability data pipeline tool. The flaw exists in the KeyPartitioner::partition function, where the set_uri_query parameter fails to sanitize user-supplied input before incorporating it into SQL statements. Remote attackers can craft malicious SQL payloads to extract sensitive database information without authentication. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). The issue is network-exploitable and requires no user interaction, exposing confidentiality, integrity, and availability of backend data stores.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the backend database via the set_uri_query parameter, leading to full disclosure of sensitive records and potential data tampering.

Affected Products

Datadog Vector v0.54.0
Deployments using the KeyPartitioner sink component
Pipelines exposing the set_uri_query parameter to untrusted input

Discovery Timeline

2026-06-15 - CVE-2026-39196 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39196

Vulnerability Analysis

Datadog Vector is an open-source pipeline for collecting, transforming, and routing observability data. The KeyPartitioner::partition function is responsible for evaluating partition key templates against incoming events. In v0.54.0, this function passes the set_uri_query parameter into a SQL statement without parameterization or escaping.

An attacker who controls the URI query value reaching the partitioner can inject SQL syntax that the database executes verbatim. Because Vector frequently sits between high-volume telemetry sources and downstream stores, the injected queries run against databases containing logs, metrics, and security telemetry. Exploitation yields data exfiltration, record modification, or denial of service against the connected data store.

Root Cause

The root cause is missing input neutralization in the partition key construction path. The set_uri_query parameter is concatenated into SQL strings rather than bound as a parameter via prepared statements. Any metacharacter such as a single quote, semicolon, or comment marker breaks out of the intended string context. This is a textbook [CWE-89] failure where dynamic query construction trusts attacker-influenced input.

Attack Vector

The attack vector is network-based and unauthenticated. An adversary sends crafted HTTP requests whose URI query components flow into a Vector source feeding the vulnerable KeyPartitioner. The injected SQL fragment executes when Vector evaluates the partition key during sink processing. No privileges, user interaction, or local access are required. A proof-of-concept is published in a GitHub Gist PoC Repository demonstrating the injection payload structure.

Detection Methods for CVE-2026-39196

Indicators of Compromise

HTTP requests containing SQL metacharacters such as ', --, ;, UNION SELECT, or OR 1=1 in URI query strings reaching Vector ingress endpoints.
Vector log entries referencing KeyPartitioner::partition with abnormally long or syntactically suspicious set_uri_query values.
Unexpected database errors or schema enumeration queries originating from the Vector service account.
Outbound connections from Vector hosts to attacker-controlled infrastructure following anomalous query activity.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects URI query parameters destined for Vector HTTP sources for SQL injection signatures.
Enable database audit logging on stores connected to Vector sinks and alert on queries that deviate from the expected partitioner template.
Correlate Vector application logs with downstream database query logs to identify untemplated SQL constructs.

Monitoring Recommendations

Baseline normal set_uri_query parameter values and flag statistical outliers in length, character entropy, or keyword frequency.
Monitor for sudden spikes in SELECT, INFORMATION_SCHEMA, or pg_catalog queries originating from the Vector identity.
Alert on Vector process crashes or partition failures that may indicate exploitation attempts disrupting normal operations.

How to Mitigate CVE-2026-39196

Immediate Actions Required

Inventory all Datadog Vector v0.54.0 deployments and identify pipelines that expose the set_uri_query parameter to untrusted network input.
Restrict network access to Vector HTTP sources using firewall rules or service mesh policies until a patched release is applied.
Rotate database credentials used by Vector sinks if exploitation is suspected, and review database audit logs for unauthorized queries.
Apply the principle of least privilege to the database account used by Vector, limiting it to required tables and operations only.

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry. Consult the upstream Datadog Vector project release notes and security advisories for an updated build addressing the KeyPartitioner::partition flaw. Until a patch is available, treat the component as untrusted when handling external URI query input.

Workarounds

Disable or remove sinks that invoke KeyPartitioner with attacker-controlled set_uri_query values.
Insert a Vector transform stage that validates and sanitizes URI query fields, rejecting events containing SQL metacharacters.
Place an upstream reverse proxy that strips or normalizes the URI query component before events reach Vector.
Move the backing database behind a network segmentation boundary unreachable from the Vector host except through approved query templates.

bash

# Configuration example: restrict Vector HTTP source to internal sources only
# /etc/vector/vector.toml
[sources.http_in]
type = "http_server"
address = "127.0.0.1:8080"
encoding = "json"

[transforms.sanitize_query]
type = "remap"
inputs = ["http_in"]
source = '''
  if match(string!(.uri_query), r'[\'";]|--|/\*|UNION|SELECT') {
    abort
  }
'''