CVE-2026-44965 Datadog CVE debrief

Who should care

Users of the Datadog Android application, particularly those with sensitive infrastructure data displayed on their devices, should be aware of this vulnerability and take steps to mitigate it. This includes verifying their application version, updating to v545-5.9.2 or later, and monitoring for suspicious activity. Additionally, operators, platform administrators, and security teams should review their configurations and implement compensating controls for exposed systems.

Technical summary

CVE-2026-44965 is a vulnerability in the Datadog Android application prior to v545-5.9.2. The issue arises from six App Widget configuration activities being exported with no permission guard. A co-installed malicious application can brute-force the widget ID, load the matching widget's stored session, and automatically log in as that user, exposing live infrastructure data through a visual side channel. The vulnerability requires a malicious application co-installed on the victim's device, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally.

Defensive priority

Datadog Android application users should verify their application version and update to v545-5.9.2 or later to mitigate this vulnerability.

Recommended defensive actions

• Update Datadog Android application to v545-5.9.2 or later
• Verify application version and configurations
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE-2026-44965 vulnerability affects Datadog Android application versions prior to v545-5.9.2. Six App Widget configuration activities are exported with no permission guard, allowing a co-installed malicious application to brute-force the widget ID and load the matching widget's stored session, automatically logging in as that user. The vulnerability requires a malicious application co-installed on the victim's device, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally. To verify and mitigate this vulnerability, defenders should review their application version, configurations, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.