CVE-2026-47364 Overview
CVE-2026-47364 is an information exposure vulnerability [CWE-200] in the Datadog Android application. Versions prior to v545-5.9.2 tag Crashlytics data with the user's Datadog UUID without providing a user-facing opt-out mechanism. As a result, the Datadog user UUID and associated crash data become visible within Firebase Crashlytics.
According to the vendor advisory, the UUID is not identifying outside Datadog's own systems. However, the lack of opt-out control constitutes an unintended data flow between the mobile application and a third-party telemetry service.
Critical Impact
The Datadog user UUID and crash data are exposed to Firebase Crashlytics with no user-facing opt-out available in affected versions.
Affected Products
- Datadog Android application versions prior to v545-5.9.2
- Fixed version: Datadog Android application v545-5.9.2 and later
- Impacted telemetry path: Firebase Crashlytics integration on Android
Discovery Timeline
- 2026-08-07 - CVE-2026-47364 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-47364
Vulnerability Analysis
The Datadog Android application integrates Firebase Crashlytics for crash reporting. In versions prior to v545-5.9.2, the application attaches the user's Datadog UUID as metadata to Crashlytics reports. The tagging occurs automatically without prompting the user for consent and without offering a runtime setting to disable it.
Crash reports flow from the mobile device to Firebase Crashlytics infrastructure operated by Google. Once ingested, the tagged UUID and any accompanying crash context become visible within the Crashlytics console. The exposure is classified as an information disclosure issue under CWE-200 because sensitive identifiers cross a trust boundary without user awareness.
Exploitation does not require code execution or memory corruption. The behavior is present in the application's default configuration.
Root Cause
The root cause is a design decision to enable Crashlytics reporting with user UUID tagging by default, without implementing the opt-in reporting pattern documented in the Firebase Crashlytics Guide. Datadog resolved the issue in v545-5.9.2 by changing the data flow to remove the identifier or gate its collection.
Attack Vector
The attack vector is network-adjacent. An actor with access to the Firebase Crashlytics project or to intermediate telemetry data can observe the Datadog UUID and correlate it with crash events. The UUID itself is not directly identifying outside Datadog's systems, but combining it with other data sources could enable user correlation. No user interaction beyond normal application use is required for the data to be transmitted.
The vulnerability manifests through the mobile telemetry pipeline rather than through classical exploitation. See the Datadog Trust Resource for the vendor advisory.
Detection Methods for CVE-2026-47364
Indicators of Compromise
- Datadog Android application installations reporting a version string below v545-5.9.2 in mobile device management inventories.
- Firebase Crashlytics events originating from the Datadog Android application containing user UUID custom keys.
- Outbound traffic from mobile endpoints to crashlytics.googleapis.com or firebase-settings.crashlytics.com correlated with the Datadog app package.
Detection Strategies
- Inventory installed mobile applications through unified endpoint management tooling and flag Datadog Android builds below v545-5.9.2.
- Review Firebase Crashlytics console custom key fields for the presence of Datadog UUID values in historical reports.
- Correlate mobile telemetry egress with application version metadata to identify devices still emitting tagged crash data.
Monitoring Recommendations
- Track Datadog Android application version distribution across the managed device fleet weekly until remediation is complete.
- Alert on installations of vulnerable Datadog Android versions on corporate-managed devices.
- Audit third-party SDK telemetry destinations from mobile applications handling business identifiers.
How to Mitigate CVE-2026-47364
Immediate Actions Required
- Upgrade the Datadog Android application to v545-5.9.2 or later on all managed devices.
- Communicate the update requirement to bring-your-own-device users who have installed the Datadog app.
- Review existing Firebase Crashlytics data collected by prior versions and apply retention or deletion policies as appropriate.
Patch Information
Datadog resolved the issue in version v545-5.9.2 of the Android application. Users should install the update from the Google Play Store or through their organization's managed application distribution channel. Refer to the Datadog Trust Resource for vendor guidance.
Workarounds
- Uninstall the Datadog Android application until the update to v545-5.9.2 can be applied on devices where the exposure is not acceptable.
- Disable Firebase Crashlytics data collection at the platform level using the opt-in reporting pattern where organizational tooling permits, referencing the Firebase Crashlytics Guide.
- Restrict outbound network access from mobile devices to Firebase Crashlytics endpoints where policy allows, as a temporary containment measure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
