Datadog up to 5.9.1 Android App Widget Configuration Activities EXTRA_APPWIDGET_ID information disclosure

Summaryinfo

A vulnerability was found in Datadog up to 5.9.1. It has been rated as problematic. This affects an unknown function of the component Android App Widget Configuration Activities. The manipulation of the argument EXTRA_APPWIDGET_ID leads to information disclosure. This vulnerability is referenced as CVE-2026-44965. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Datadog up to 5.9.1. This issue affects an unknown function of the component Android App Widget Configuration Activities. The manipulation of the argument EXTRA_APPWIDGET_ID with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base WidgetActivity that reads AppWidgetManager.EXTRA_APPWIDGET_ID from Intent extras and, when no resolved deep-link destination is supplied, uses that caller-controlled widget ID to look up the stored widget definition, fetch the associated user session, and perform an automatic login with source UserSessionSourceLogin.Automatic. Android App Widget IDs are small sequential integers assigned by AppWidgetManager. A zero-permission co-installed application can brute-force them by launching any of the six configuration activities with EXTRA_APPWIDGET_ID set to 1..N until one matches a configured widget on the victim device. When a match occurs, the activity foregrounds with the victim's session already loaded and renders the widget configuration UI, which is backed by live data pickers (SLOs, dashboards, incident severities and types, on-call pages and shifts) fetched through the victim's authenticated HTTP client. Exfiltration is screen-visible only — programmatic return of data to the caller is not possible from these activities. Disclosure is therefore a visual side-channel: accessibility services, screen recording, or screenshot capture. Preconditions: a malicious co-installed application, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally.

The advisory is shared at trust.datadoghq.com. The identification of this vulnerability is CVE-2026-44965 since 05/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 5.9.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Management Software

Name

• Datadog

Version

• 5.9.0
• 5.9.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion