Description
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history).
Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.
Published: 2026-08-07
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Datadog Android application, in versions prior to v554‑5.9.4, records notification and search data in two Room‑backed SQLite databases that lack encryption. These databases contain sensitive fields such as notification titles, messages, recipients, service identifiers, tags, and incident deep‑links, as well as the user’s full in‑app search history. Because the data are stored in cleartext, any actor who can bypass the application sandbox can read these files locally, thereby exposing operational metadata and user activity. This constitutes an information‑disclosure flaw classified as CWE‑922.

Affected Systems

Datadog Android App – versions prior to v554‑5.9.4 store two cleartext Room‑backed SQLite databases (LocalNotificationDatabase and SearchRecentDatabase) in /data/data/com.datadog.app/databases/. The databases contain sensitive notification and search data in plain text.

Risk and Exploitability

Exploitation depends on device compromise: a rooted or jailbroken device, a misconfigured android:allowBackup backup, physical handover scenarios, or forensic acquisition grants an attacker read access to the database files. The CVSS score of 4.6 indicates medium severity; loss of confidential operational data could be significant. The vulnerability is not listed in the CISA KEV catalog, and its EPSS score is not available, but the risk remains high for any device that is compromised.

Generated by OpenCVE AI on August 8, 2026 at 02:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest version of the Datadog Android app that protects its databases with SQLCipher or another encryption mechanism.
  • Configure the app to set android:allowBackup="false" in the manifest to prevent accidental backup of the SQLite files.
  • Ensure devices running the app remain unrooted and employ device management policies to restrict physical handover and forensic extraction of internal storage.

Generated by OpenCVE AI on August 8, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 08 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Datadog
Datadog android App
Vendors & Products Datadog
Datadog android App

Sat, 08 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Datadog Android App Stores Sensitive Data in Cleartext SQLite Databases

Sat, 08 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Description The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition. In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.

Fri, 07 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Datadog Android App Stores Sensitive Data in Cleartext SQLite Databases

Fri, 07 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.
Weaknesses CWE-922
References

Subscriptions

Datadog Android App
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-08-08T01:05:53.195Z

Reserved: 2026-05-19T15:00:09.319Z

Link: CVE-2026-47362

cve-icon Vulnrichment

Updated: 2026-08-07T18:28:43.079Z

cve-icon NVD

Status : Received

Published: 2026-08-07T18:17:15.887

Modified: 2026-08-08T02:17:17.600

Link: CVE-2026-47362

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T20:40:54Z

Weaknesses
  • CWE-922

    Insecure Storage of Sensitive Information