CVE-2026-47362 Datadog CVE debrief

Who should care

Organizations using the Datadog Android application prior to v554-5.9.4 should update to the latest version to mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the potential exposure of sensitive information. Affected teams should review their current deployments, assess their risk, and ensure that all necessary updates and mitigations are applied.

Technical summary

The Datadog Android application prior to v554-5.9.4 stores sensitive content in plaintext within two Room-backed SQLite databases: LocalNotificationDatabase and SearchRecentDatabase. LocalNotificationDatabase contains notification titles, messages, recipients, services, tags, and on-call/incident deep links, while SearchRecentDatabase stores the user's full in-app search history. This vulnerability allows any actor able to bypass the app sandbox to read these databases in plaintext, potentially exposing sensitive information. To mitigate this vulnerability, it is recommended to update the Datadog Android application to v554-5.9.4 or later.

Defensive priority

Medium-priority defensive review recommended due to potential local exposure of sensitive information.

Recommended defensive actions

• Review and apply the vendor's patch to update the Datadog Android application to v554-5.9.4 or later.
• Conduct a thorough inventory of affected systems and ensure they are updated.
• Implement additional monitoring to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from the CVE Program and NVD suggests plaintext storage of sensitive content in two Room-backed SQLite databases within the Datadog Android application prior to v554-5.9.4. The CVE record indicates that LocalNotificationDatabase and SearchRecentDatabase store sensitive information such as notification titles, messages, recipients, services, tags, on-call/incident deep links, and the user's full in-app search history in plaintext. This allows any actor able to bypass the app sandbox to read these databases in plaintext. To verify and mitigate this vulnerability, defenders should review the official CVE record and vendor advisory, assess their current deployments of the Datadog Android application, and ensure that all affected systems are updated to version v554-5.9.4 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.