Description
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed).
A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest).
Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.
Published: 2026-08-07
Score: 4.6 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Datadog Android application writes operationally sensitive content to plain text SQLite databases via Room. The databases contain notification titles, messages, recipients, incident links, and every in‑app search query. The lack of encryption (no SQLCipher configuration) means any user who can access the internal storage gains visibility into customer infrastructure metadata, incident acknowledgements and query history, constituting an information disclosure flaw classified as CWE‑922.

Affected Systems

Datadog Android App – the LocalNotificationDatabase and SearchRecentDatabase located in /data/data/com.datadog.app/databases/. No specific product version information is provided, but all installed instances of the app store these databases in cleartext.

Risk and Exploitability

Exploitation depends on device compromise: a rooted or jailbroken device, a misconfigured android:allowBackup backup, physical handover scenarios, or forensic acquisition grants an attacker read access to the database files. The CVSS score of 4.6 indicates medium severity; loss of confidential operational data could be significant. The vulnerability is not listed in the CISA KEV catalog, and its EPSS score is not available, but the risk remains high for any device that is compromised.

Generated by OpenCVE AI on August 7, 2026 at 20:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest version of the Datadog Android app that protects its databases with SQLCipher or another encryption mechanism.
  • Configure the app to set android:allowBackup="false" in the manifest to prevent accidental backup of the SQLite files.
  • Ensure devices running the app remain unrooted and employ device management policies to restrict physical handover and forensic extraction of internal storage.

Generated by OpenCVE AI on August 7, 2026 at 20:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Datadog Android App Stores Sensitive Data in Cleartext SQLite Databases

Fri, 07 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.
Weaknesses CWE-922
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-08-07T18:28:47.950Z

Reserved: 2026-05-19T15:00:09.319Z

Link: CVE-2026-47362

cve-icon Vulnrichment

Updated: 2026-08-07T18:28:43.079Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T20:45:03Z

Weaknesses
  • CWE-922

    Insecure Storage of Sensitive Information