CVE-2026-47362

Executive Summary

CVE-2026-47362 is a sensitive data exposure vulnerability (CWE-922: Insecure Storage of Sensitive Information) affecting the Datadog Android application (com.datadog.app). The application stores operationally sensitive content — including incident notification metadata, on-call routing data, service names, and every in-app search query — in plaintext SQLite databases via the Room persistence library without any encryption layer (no SQLCipher, SupportFactory, or openHelperFactory configuration exists in the repository). The impact is data-at-rest compromise on any device where the Android application sandbox is bypassed, including rooted/jailbroken devices, misconfigured adb backup scenarios, physical device handover, and forensic acquisition. The vendor has not released a patch as of this report; all affected versions remain vulnerable.

Technical Analysis

The Datadog Android application leverages the Room persistence library to manage two SQLite databases, both stored in cleartext at /data/data/com.datadog.app/databases/:

1. LocalNotificationDatabase (table: local_notifications) — Stores columns including title, message, recipient, service, tags, and on-call/incident deep links. This database contains real-time incident routing data: which teams receive notifications, which services are monitored, and operational tags describing infrastructure components. The recipient column in particular reveals organizational structure and on-call rotation assignments.

2. SearchRecentDatabase (table: search_recents) — Stores every in-app search query the user types. These free-text queries frequently contain service names, dashboard names, metric identifiers, infrastructure component names (hostnames, IP addresses, cloud resource identifiers), and queries of interest to the organization's monitoring operations.

Vulnerability Mechanism: The Room database manager in the Datadog app is instantiated with default factory settings. A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any custom Room encryption configuration returns zero matches. The Room.databaseBuilder() invocation lacks any .openHelperFactory() call, meaning the standard FrameworkSQLiteOpenHelperFactory is used, which delegates to the Android framework's unencrypted SQLite implementation.

Attack Surface:

• Rooted devices: An attacker with root privileges reads /data/data/com.datadog.app/databases/ directly, bypassing the Android sandbox.
• adb backup: If android:allowBackup is misconfigured to true in any build flavor, adb backup com.datadog.app extracts the application's private data directory, including both databases, to the attacker's machine. The resulting backup file is often unencrypted or weakly protected.
• Physical device access: Handover of devices between employees (common in SOC environments with shared duty devices) without proper wipe exposes residual data.
• Forensic acquisition: Standard forensic tools (Cellebrite, Magnet AXIOM, etc.) extract application sandbox data from device images without any decryption requirement.

The vulnerability class is CWE-922 — the application fails to apply additional cryptographic protection to data that is operationally sensitive, relying solely on the Android application sandbox as the only line of defense.

Exploitation Scenarios

The following attack chain assumes an attacker with physical device access or root privileges on a target device running the Datadog Android app:

Step 1 — Target Identification & Reconnaissance: The attacker identifies a target device used by a DevOps/SRE engineer or on-call responder. Physical access or device acquisition is obtained through social engineering, device loss, or insider access. Alternatively, the attacker gains root or ADB access via a malicious charger (Juice Jacking), an unlocked bootloader, or a previously exploited device.

Step 2 — Data Extraction (Trigger/Weaponization): On a rooted device, the attacker executes:

adb shell
su
cp -r /data/data/com.datadog.app/databases/ /sdcard/exfil/

Alternatively, if allowBackup is enabled:

adb backup -f datadog_backup.ab com.datadog.app
java -jar abe.jar unpack datadog_backup.ab datadog_backup.tar
tar -xf datadog_backup.tar

For non-rooted devices with USB debugging enabled and a user-approved RSA key, adb backup requires no root privileges — it is a standard Android backup operation. On Windows, the backup file can be unpacked using android-backup-extractor or abe.jar. Many vendors ship adb backup enabled by default with allowBackup="true".

Step 3 — Payload Extraction & Parsing: The attacker opens the extracted SQLite databases with any SQLite browser or command-line tool:

sqlite3 databases/local_notifications.db
SELECT * FROM local_notifications;
sqlite3 databases/search_recents.db
SELECT * FROM search_recents;

The local_notifications table yields — for each record — the service name being monitored, the notification recipient (often a person's name or PagerDuty escalation policy), the incident deep link URL (which may contain API tokens or organization IDs), and the incident category tags. The search_recents table yields the complete search history: infrastructure component names, metric queries, dashboard IDs, and any terms of operational interest.

Step 4 — Post-Exploitation Impact: The attacker now possesses:

• Complete mapping of monitored services and their notification recipients.
• On-call escalation structure (from the recipient deep links).
• Free-text search queries revealing sensitive infrastructure naming conventions, internal project code names, and specific operational queries.
• Potential deep-link tokens that may be replayed to access incident management APIs.

These data points enable:

• Targeted social engineering: The attacker knows exactly which teams handle which services and who is on-call.
• Further infrastructure compromise: Service names and deep-link tokens facilitate reconnaissance for direct API attacks.
• Competitive intelligence theft: Search queries reveal the organization's observability priorities, planned migrations, or specific problem areas.

Impact Assessment

Confidentiality Impact: HIGH — The exposed data includes operational metadata that is sensitive in nature, potentially containing infrastructure details, personnel information, and organizational structure.

Integrity Impact: NONE — This is a data-at-rest confidentiality issue; no data integrity degradation exists.

Availability Impact: NONE — No denial-of-service or availability concerns arise from this vulnerability.

CVSS Score: N/A — No official CVSS vector has been assigned by the CNA. Based on qualitative assessment, this maps to a Medium severity issue (CVSS v3.1 approximate score 4.6–5.5) given the local attack vector, physical or root requirements, and the sensitivity of exposed operational data.

Blast Radius:

• Directly affected: All Datadog Android application users in enterprise environments with on-call duties, especially SRE teams, DevOps engineers, and infrastructure monitoring staff.
• Indirectly affected: The organizations relying on Datadog for monitoring — exposed service names and infrastructure details reduce the attacker's reconnaissance cost in follow-up attacks.
• Compounding risk: On shared or corporate-managed devices where the application is deployed via enterprise MDM, the risk profile increases because multiple personnel may use a single device, and MDM containers may not isolate application data.

Detection Guidance

Sigma Rule

title: Suspicious ADB Backup of Datadog App Sandbox
id: 4f6d1c2a-8e3b-4a5c-9d0e-7b2f1a9c3e5d
status: experimental
description: Detects adb backup attempts targeting the Datadog Android application, indicating potential data exfiltration of plaintext SQLite databases.
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    category: process_creation
    product: windows
    definition: 'Requires Sysmon or equivalent process creation logging'
detection:
    selection_adb:
        Image|endswith: '\adb.exe'
        CommandLine|contains|all:
            - 'backup'
            - 'com.datadog.app'
    selection_backup_file:
        CommandLine|contains:
            - '-f datadog_backup'
            - 'datadog_*.ab'
    condition: selection_adb and selection_backup_file
falsepositives:
    - Legitimate backup procedures by authorized IT personnel
    - Developer debugging sessions
level: high
tags:
    - attack.t1027
    - attack.t1005
    - cve.2026.47362

YARA Rule

rule Datadog_Plaintext_SQLite_Exfil
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects extraction of Datadog Android app plaintext SQLite database files"
        cve = "CVE-2026-47362"
        date = "2026-05-15"
        severity = "high"
    strings:
        $db_path = /databases\/(local_notifications|search_recents)\.db/
        $table_local = "local_notifications" ascii nocase
        $table_search = "search_recents" ascii nocase
        $col_recipient = "recipient" ascii nocase
        $col_service = "service" ascii nocase
        $col_deeplink = /dd\.(incident|oncall|service)[\/]?/ ascii nocase
        $room_marker = "Room" ascii nocase
        $datadog_pkg = "com.datadog.app" ascii nocase
    condition:
        (uint32(0) == 0x31454253) and  # SQLite magic header "SQLi"
        (2 of ($table*, $col_*)) and
        ($datadog_pkg or $room_marker)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-47362 Datadog Android plaintext SQLite DB exfiltration via adb backup"; flow:established,to_server; content:"backup"; nocase; content:"com.datadog.app"; nocase; pcre:"/databases\/(local_notifications|search_recents)\.db/"; classtype:policy-violation; sid:202647362; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-47362;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [ process where process.name == "adb.exe" and process.args : ("backup", "com.datadog.app") ]
  [ file where file.name : ("local_notifications.db", "search_recents.db") and event.action in ("rename", "copy") ]

process where process.name == "adb.exe" and process.command_line : "*backup*com.datadog.app*"
and not process.command_line : "*--noapk*"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| where EventCode == 4688
| search New_Process_Name="*adb.exe" AND CommandLine="*backup*com.datadog.app*"
| eval attack_phase="data_exfiltration"
| table _time, User, New_Process_Name, CommandLine, Parent_Process_Name
| stats count by User, attack_phase

Wazuh OSSEC Rule

<group name="local, adb_exfil,">
  <rule id="101362" level="12">
    <if_sid>550</if_sid>
    <match>adb.exe</match>
    <regex>backup.*com\.datadog\.app</regex>
    <description>CVE-2026-47362: ADB backup of Datadog Android app — possible plaintext SQLite database exfiltration</description>
    <mitre>
      <id>T1005</id>
    </mitre>
    <group>data_exfiltration,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not provided a fix advisory, and no version update addresses this issue.

1. Immediate Mitigations:

• Android device management: Enforce a comprehensive MDM policy on all enterprise devices running the Datadog app. Disable USB debugging via device policy where feasible. Implement screen-lock and device-encryption requirements (full-disk/File-Based Encryption provides at-rest protection at the platform level).
• Verify allowBackup setting: Request that Datadog confirm both the debug and release manifests contain android:allowBackup="false" for the com.datadog.app application. If not, treat this as an additional urgent finding. Enterprise admins can enforce allowBackup="false" via MDM profiles on managed devices.
• Device hygiene: Enforce mandatory device wipe policies for device handover or return. Never hand over devices among on-call team members without factory reset. Use containerized work profiles (managed device mode) where the Datadog app data is further isolated.
• Detection deployment: Deploy the Sigma, Elastic, and Splunk detections above to catch adb backup activity on managed workstations and jump boxes.

2. Patch/Upgrade Steps:

• Monitor Datadog's official changelog and security advisories at security.datadoghq.com and github.com/DataDog/dd-sdk-android for a fix release.
• When available, upgrade to the patched version that implements SQLCipher or equivalent encryption for Room databases. The fix is expected to be a dependency update adding net.zetetic:android-database-sqlcipher with a SupportFactory passed to openHelperFactory() in the Room builder.

3. Long-Term Hardening:

• Datadog should implement encryption-at-rest for all Room-persisted databases, ideally via SQLCipher with a key stored in Android Keystore or an appropriate key management system.
• Datadog should treat operational data (recipients, service names, search history) as sensitive PII/operational metadata and apply the principle of least persistence: reduce the amount of historically persisted data, implement data-retention policies, and scrub sensitive fields before database write.
• Enterprise customers should reevaluate whether sensitive operational data should be stored on mobile endpoints at all; consider policies prohibiting free-text searches of sensitive infrastructure names on mobile devices.
• Security teams should classify mobile endpoint data-at-rest risks in their threat model, accounting for device loss and managed-device handover scenarios.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47362
2. MITRE CWE-922: Insecure Storage of Sensitive Information: https://cwe.mitre.org/data/definitions/922.html
3. Datadog Android SDK Repository (affected code, Room usage): https://github.com/DataDog/dd-sdk-android
4. OWASP Mobile Application Security Testing Guide (MASTG) — Data Storage and Privacy Requirements: https://owasp.org/www-project-mobile-security-testing-guide/
5. Android Developer Documentation — AllowBackup Security Considerations: https://developer.android.com/guide/topics/data/autobackup

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE as of the publication date. The CISA Known Exploited Vulnerabilities catalog does not include CVE-2026-47362.