dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.
CVE-2026-50275 is a high-severity vulnerability in DataDog's dd-trace-php library prior to version 1.19.2. It involves the ddtrace_deserialize_baggage function parsing incoming W3C baggage HTTP headers without enforcing limits on the number or size of key-value pairs. This allows a remote unauthenticated attacker to cause unbounded CPU and memory consumption by sending large or numerous baggage items. The issue is fixed in version 1.19.2.
CVE-2026-54788 is a high-severity vulnerability in DataDog's dd-trace-rs Rust library for application performance monitoring. Versions from 0.1.0 up to but not including 0.3.3 parse the W3C tracestate header and collect all semicolon-separated key-value pairs in the Datadog dd=... vendor entry into a HashMap without limits. This allows a remote unauthenticated attacker to send an arbitrarily large dd=... entry, causing excessive CPU and memory consumption and resulting in denial of service. The issue is fixed in version 0.3.3.
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) are exported with no permission guard. Each accepts a caller-supplied AppWidgetManager.EXTRA_APPWIDGET_ID and, when no deep-link destination is resolved, uses it to load the matching widget's stored session and automatically log in as that user. Because Android widget IDs are small sequential integers, a co-installed application can brute-force this value to find one that matches a widget configured on the victim's device.
This requires:
A malicious application co-installed on the victim's device.
At least one of the six widgets configured on the victim's home screen.
An active Datadog session cached locally.
Impact: The matching configuration activity opens in the foreground under the victim's session and renders live infrastructure data. Exposure is limited to a visual side channel (e.g., screen recording or accessibility services); the calling application cannot programmatically read the rendered data.
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.
This requires:
A malicious application co-installed on the victim's device.
An active Datadog session in the Android app.
Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.
This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app.
Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation.
This requires a malicious application co-installed on the victim's device.
Impact: A co-installed application can silently dismiss the victim's Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history).
Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.
GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog. This vulnerability is fixed in .
GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs.
CVE-2026-33728 is a critical deserialization vulnerability in DataDog's dd-trace-java agent versions 0.40.0 through prior to 1.60.3. The vulnerability arises from the RMI instrumentation registering a custom endpoint that deserializes incoming data without applying serialization filters on JDK 16 and earlier. Exploitation requires that dd-trace-java is attached as a Java agent on a vulnerable JDK version, a network-reachable JMX/RMI port is configured, and a gadget-chain-compatible library is present on the classpath. Successful exploitation could lead to remote code execution. For JDK 17 and later, no action is required, but upgrading is recommended. For vulnerable versions, upgrading to dd-trace-java 1.
CVE-2026-22871 is a high-severity path traversal vulnerability in DataDog's GuardDog CLI tool versions prior to 2.7.1. The flaw exists in the safe_extract() function, allowing malicious PyPI packages to write files outside the intended extraction directory. This arbitrary file overwrite can lead to remote code execution without requiring authentication, though user interaction is needed to trigger the extraction. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk. GuardDog is used to identify malicious PyPI packages, so compromised environments could be exploited by attackers to execute arbitrary code. The issue is fixed in version 2.
CVE-2026-22870 is a high-severity vulnerability in DataDog's GuardDog CLI tool versions prior to 2.7.1. The flaw arises from improper handling of highly compressed ZIP archives during extraction, specifically a lack of validation on decompressed file sizes. This allows attackers to craft malicious PyPI packages containing zip bombs that expand to consume gigabytes of disk space from a few megabytes of compressed data, leading to denial of service (DoS). Exploitation requires no privileges but does require user interaction to extract the malicious archive. The vulnerability impacts the availability of systems running vulnerable GuardDog versions. The issue has been fixed in version 2.7.1.
The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this directory is only run by the Agent during Agent install/upgrades. This could allow an attacker with local access to modify files in this directory, which would then subsequently be run when the Agent is upgraded, resulting in local privilege escalation. This issue requires local access to the host and a valid low privilege account to be vulnerable. Note that this vulnerability only impacts the Linux Host Agent. Other variations of the Agent including the container, kubernetes, windows host and other agents are not impacted. Version 7.71.0 contains a patch for the issue.