CVE-2026-47362: Datadog Android Information Disclosure

CVE-2026-47362 Overview

CVE-2026-47362 affects the Datadog Android application in versions prior to v554-5.9.4. The application stores sensitive user data in two Room-backed SQLite databases without encryption. The LocalNotificationDatabase retains notification titles, messages, recipients, service names, tags, and on-call and incident deep links. The SearchRecentDatabase retains the user's complete in-app search history. Any actor able to bypass the Android application sandbox can read these databases in plaintext. The weakness is categorized as insecure storage of sensitive information [CWE-922].

Critical Impact
An attacker with physical device access or sandbox escape can extract on-call routing details, incident deep links, and search history in plaintext.

Affected Products

Datadog Android application versions prior to v554-5.9.4
LocalNotificationDatabase component (Room/SQLite)
SearchRecentDatabase component (Room/SQLite)

Discovery Timeline

2026-08-07 - CVE-2026-47362 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-47362

Vulnerability Analysis

The Datadog Android application persists two categories of sensitive data through Room, the Android Jetpack persistence layer that wraps SQLite. Neither database applies at-rest encryption. The LocalNotificationDatabase stores push notification payloads that include operational context such as on-call routing, incident identifiers, service names, and deep links used to open specific Datadog resources. The SearchRecentDatabase retains every recent query the user issued inside the app.

An attacker with the ability to read the app's private storage directory obtains the raw .db files. Standard SQLite tooling reads the rows without any authentication or key material. The impact is confined to confidentiality; integrity and availability are not affected.

Root Cause

The root cause is insecure storage of sensitive information [CWE-922]. The Room databases were created with the default SQLite backend rather than an encrypted backend such as SQLCipher. Notification content and search history were treated as non-sensitive despite containing operational intelligence about incidents, on-call staff, and internal services.

Attack Vector

Exploitation requires local access to the databases inside the app sandbox at /data/data/com.datadog.app/databases/. Realistic paths include a rooted or physically compromised device, an Android backup that includes the app's data, a malicious application chaining a sandbox escape, or a device forensic acquisition. Remote exploitation over the network is not possible.

See the MITRE CWE-922 definition for background on insecure storage patterns and the Zetetic SQLCipher for Android project for the encryption library commonly used to remediate this class of issue.

Detection Methods for CVE-2026-47362

Indicators of Compromise

Presence of LocalNotificationDatabase or SearchRecentDatabase files copied outside the app sandbox, for example inside adb backup archives or forensic images.
Installed Datadog Android application reporting a version string lower than v554-5.9.4.
Unexpected adb pull or run-as activity targeting the Datadog package's databases/ directory.

Detection Strategies

Inventory managed Android devices through mobile device management (MDM) and flag installations of the Datadog app below v554-5.9.4.
Monitor endpoint telemetry for rooting frameworks, su binaries, and Magisk modules on devices that hold the Datadog app.
Review Datadog audit logs for anomalous mobile session activity that could indicate credential or session reuse following device compromise.

Monitoring Recommendations

Alert on Android backup operations that include the Datadog package data.
Track deep-link URL access patterns for on-call and incident resources originating from unexpected user agents or IP ranges.
Correlate lost or stolen device reports with subsequent access to Datadog notification content.

How to Mitigate CVE-2026-47362

Immediate Actions Required

Upgrade the Datadog Android application to v554-5.9.4 or later on every managed device.
Enforce full-disk encryption, screen lock, and lockout policies through MDM on devices that run the Datadog app.
Revoke and rotate any session tokens associated with devices known or suspected to be rooted, lost, or forensically imaged.

Patch Information

Datadog resolved the issue in Android application version v554-5.9.4. Refer to Datadog Trust Insights for the vendor advisory and release details.

Workarounds

Restrict installation of the Datadog Android application to devices enrolled in MDM with root or jailbreak detection enabled.
Disable Android backup for the Datadog package via MDM policy to prevent extraction of its private data through adb backup.
Instruct users to clear in-app search history and reinstall the app after upgrading to remove residual plaintext data.

bash

# Configuration example: block backup and require encrypted storage via MDM
# Android Enterprise application configuration (illustrative)
{
  "allowBackup": false,
  "minimumAppVersion": "554-5.9.4",
  "requireDeviceEncryption": true,
  "blockRootedDevices": true
}