CVE-2026-44965: Datadog Android Auth Bypass Vulnerability

CVE-2026-44965 Overview

CVE-2026-44965 affects the Datadog Android application in versions prior to v545-5.9.2. Six App Widget configuration activities are exported without a permission guard, allowing a co-installed malicious application to invoke them with a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID. When the extra matches a widget already configured on the victim's home screen, the activity loads the corresponding cached session and logs in as that user in the foreground. The vulnerability maps to CWE-926: Improper Export of Android Application Components. Exposure is limited to a visual side channel because the calling application cannot read the rendered UI programmatically.

Critical Impact
A co-installed Android application can brute-force sequential widget IDs to trigger the Datadog app to open in the foreground under the victim's session and display live infrastructure data.

Affected Products

Datadog Android application versions prior to v545-5.9.2
Affected activities: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity
Affected activities: OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity

Discovery Timeline

2026-08-07 - CVE-2026-44965 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-44965

Vulnerability Analysis

The Datadog Android application exports six App Widget configuration activities without declaring a permission requirement. Android considers any activity referenced in an intent filter, or explicitly marked android:exported="true", callable by other installed applications unless a signature or custom permission is enforced. Each of the affected activities accepts the standard AppWidgetManager.EXTRA_APPWIDGET_ID extra from the caller and treats it as trusted input.

When the activity cannot resolve a deep-link destination, it falls back to loading the widget's stored session state using the caller-supplied widget ID. This automatically authenticates the activity's UI as the widget's owner. Android widget IDs are small sequential integers, so a malicious co-installed app can iterate the identifier space to find one that matches an existing widget on the victim's device.

Exploitation requires three preconditions: a malicious application already installed on the device, at least one of the six widgets configured on the victim's home screen, and an active cached Datadog session. Data exfiltration is constrained to a visual side channel through screen recording APIs or accessibility services, since the invoking app cannot directly read the rendered content.

Root Cause

The root cause is improper export of Android application components [CWE-926]. The affected activities lack a permission attribute or signature-level guard, and they trust the caller-supplied widget ID without verifying that the invoking package owns or configured the widget.

Attack Vector

A malicious app running on the same device constructs an explicit Intent targeting one of the six exported activities, iterates candidate values for EXTRA_APPWIDGET_ID, and invokes startActivity(). When an ID matches, the Datadog activity opens in the foreground under the victim's cached session. The attacker captures rendered content using screen recording or accessibility services.

// Example exploitation described in prose
// The malicious app builds an Intent naming the exported
// activity (for example, DashboardWidgetActivity), attaches
// AppWidgetManager.EXTRA_APPWIDGET_ID with a candidate integer,
// and calls startActivity. If the ID matches a configured
// widget, Datadog auto-authenticates and renders the target
// dashboard on screen. See the Android App Widgets configuration
// reference for the intent contract:
// https://developer.android.com/develop/ui/views/appwidgets/configuration

Detection Methods for CVE-2026-44965

Indicators of Compromise

Unexpected foreground launches of Datadog widget configuration activities such as DashboardWidgetActivity or IncidentWidgetActivity outside user interaction
Screen recording or accessibility service permissions granted to newly installed applications on devices where the Datadog app is used
Repeated Intent invocations from a non-Datadog package targeting exported widget activities in device logs

Detection Strategies

Inspect Android system logs (logcat) for activity starts of the six affected classes originating from packages other than com.datadog.android
Enumerate installed applications requesting BIND_ACCESSIBILITY_SERVICE or MediaProjection alongside the Datadog client
Review mobile threat defense telemetry for apps exercising exported components of enterprise applications

Monitoring Recommendations

Monitor mobile device management (MDM) inventories for Datadog Android app versions older than v545-5.9.2
Alert on installation of unvetted third-party applications on devices used to access production infrastructure
Track user reports of unexpected Datadog app foregrounding, which indicates active exploitation attempts

How to Mitigate CVE-2026-44965

Immediate Actions Required

Update the Datadog Android application to v545-5.9.2 or later on all managed devices
Audit devices where Datadog widgets are configured and revoke accessibility or screen recording permissions from untrusted apps
Enforce mobile application vetting policies through MDM to block installation of unknown-source APKs on devices with cached Datadog sessions

Patch Information

Datadog resolved the issue in Datadog Android application v545-5.9.2 by restricting the exported widget configuration activities. Refer to the Datadog Trust Resource for the vendor advisory and remediation guidance.

Workarounds

Remove Datadog home screen widgets on devices that cannot be updated immediately, eliminating the required exploitation precondition
Sign out of the Datadog app when not in active use to invalidate the cached session leveraged by the vulnerable activities
Restrict devices that hold Datadog sessions to a managed application catalog, preventing co-installation of untrusted apps

bash

# Verify installed Datadog Android version via adb
adb shell dumpsys package com.datadog.android | grep versionName

# Force update through the managed Google Play channel
adb shell am start -a android.intent.action.VIEW \
  -d "market://details?id=com.datadog.android"