CVE-2026-47362: CWE-922 Insecure Storage of Sensitive Information in Datadog Android App
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.
AI Analysis
Technical Summary
CVE-2026-47362 identifies an insecure storage vulnerability (CWE-922) in the Datadog Android app version 5.9.4. The app stores operationally sensitive content such as notification metadata and user search queries in plaintext SQLite databases managed by Room, without any encryption configuration like SQLCipher. These databases reside in /data/data/com.datadog.app/databases/ as cleartext files, relying only on the Android application sandbox for protection. Potential exploitation scenarios include rooted or jailbroken devices, adb backups if android:allowBackup is misconfigured, physical device handover, and forensic acquisition. No patch or official remediation guidance is currently available.
Potential Impact
Sensitive operational data including incident notifications, recipient details, and user search queries are stored unencrypted on the device. If an attacker gains elevated access to the device (e.g., via rooting, jailbreaking, or improper backup configurations), they could access this data, potentially exposing customer infrastructure monitoring information and incident details. The impact is limited to scenarios where device security is compromised beyond the standard Android sandbox protections.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the app on rooted or jailbroken devices and ensure that adb backups are disabled or properly configured to prevent unauthorized data extraction. Physical device security should be maintained to prevent unauthorized access. Monitor vendor communications for updates regarding encryption or secure storage enhancements.
CVE-2026-47362: CWE-922 Insecure Storage of Sensitive Information in Datadog Android App
Description
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.
CVSS v3.1
Score 4.6medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47362 identifies an insecure storage vulnerability (CWE-922) in the Datadog Android app version 5.9.4. The app stores operationally sensitive content such as notification metadata and user search queries in plaintext SQLite databases managed by Room, without any encryption configuration like SQLCipher. These databases reside in /data/data/com.datadog.app/databases/ as cleartext files, relying only on the Android application sandbox for protection. Potential exploitation scenarios include rooted or jailbroken devices, adb backups if android:allowBackup is misconfigured, physical device handover, and forensic acquisition. No patch or official remediation guidance is currently available.
Potential Impact
Sensitive operational data including incident notifications, recipient details, and user search queries are stored unencrypted on the device. If an attacker gains elevated access to the device (e.g., via rooting, jailbreaking, or improper backup configurations), they could access this data, potentially exposing customer infrastructure monitoring information and incident details. The impact is limited to scenarios where device security is compromised beyond the standard Android sandbox protections.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the app on rooted or jailbroken devices and ensure that adb backups are disabled or properly configured to prevent unauthorized data extraction. Physical device security should be maintained to prevent unauthorized access. Monitor vendor communications for updates regarding encryption or secure storage enhancements.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- hackerone
- Date Reserved
- 2026-05-19T15:00:09.319Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a762368bf8831d539ed4427
Added to database: 08/07/2026, 18:26:48 UTC
Last enriched: 08/07/2026, 18:46:18 UTC
Last updated: 08/07/2026, 21:26:50 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.