CVE-2026-47362 identifies an insecure storage vulnerability (CWE-922) in the Datadog Android app version 5.9.4. The app stores operationally sensitive content such as notification metadata and user search queries in plaintext SQLite databases managed by Room, without any encryption configuration like SQLCipher. These databases reside in /data/data/com.datadog.app/databases/ as cleartext files, relying only on the Android application sandbox for protection. Potential exploitation scenarios include rooted or jailbroken devices, adb backups if android:allowBackup is misconfigured, physical device handover, and forensic acquisition. No patch or official remediation guidance is currently available.

Sensitive operational data including incident notifications, recipient details, and user search queries are stored unencrypted on the device. If an attacker gains elevated access to the device (e.g., via rooting, jailbreaking, or improper backup configurations), they could access this data, potentially exposing customer infrastructure monitoring information and incident details. The impact is limited to scenarios where device security is compromised beyond the standard Android sandbox protections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the app on rooted or jailbroken devices and ensure that adb backups are disabled or properly configured to prevent unauthorized data extraction. Physical device security should be maintained to prevent unauthorized access. Monitor vendor communications for updates regarding encryption or secure storage enhancements.