CVE-2026-39196 identifies a SQL injection vulnerability in Datadog Vector v0.54.0 specifically in the set_uri_query parameter of the KeyPartitioner::partition function. This vulnerability enables attackers to inject malicious SQL code, potentially leading to unauthorized access to sensitive data stored in the database. The vulnerability is publicly known but lacks a CVSS score and official remediation details. No exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to access sensitive database information by injecting crafted SQL statements via the vulnerable parameter. This could lead to data disclosure or compromise of database integrity depending on the database and application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable parameter and monitor for unusual database queries related to set_uri_query. Avoid exposing this parameter to untrusted inputs.