Datadog App up to 5.9.3 Database Storage missing encryption

Summaryinfo

A vulnerability has been found in Datadog App up to 5.9.3 and classified as problematic. This issue affects some unknown processing of the component Database Storage. This manipulation causes missing encryption. This vulnerability is handled as CVE-2026-47362. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in Datadog App up to 5.9.3. It has been declared as problematic. Affected by this vulnerability is an unknown part of the component Database Storage. The manipulation with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. The summary by CVE is:

The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.

The advisory is shared at trust.datadoghq.com. This vulnerability is known as CVE-2026-47362 since 05/19/2026. The exploitation appears to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 5.9.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Management Software

Vendor

• Datadog

Name

• App

Version

• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion