CVE-2026-39196 identifies a SQL injection vulnerability in Datadog Vector version 0.54.0. The issue exists in the set_uri_query parameter of the KeyPartitioner::partition function, enabling attackers to inject malicious SQL code. This can lead to unauthorized access to sensitive database information. The vulnerability is critical (CVSS 9.8) with network attack vector, no privileges required, and no user interaction needed. No official fix or remediation level has been published, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to full compromise of database confidentiality, integrity, and availability. This may result in unauthorized data disclosure, data modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying input validation or other protective controls around the set_uri_query parameter to mitigate injection risks. Monitor official Datadog channels for updates and apply any released fixes promptly.