PT-2026-69088

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 545-5.9.2 Description Six App Widget configuration activities—IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and...

CVE-2026-47363: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47362: Insecure Storage of Sensitive Information

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47361: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-44964: Unintended Proxy or Intermediary

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47364: Exposure of Sensitive Information to an Unauthorized Actor

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-44965: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

MAL-2026-11850 Malicious code in @servicetitan/datadog-rum (npm)

npm/@servicetitan/datadog-rum is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Datadog Browser RUM - Detect

Detects Datadog Browser RUM Real User Monitoring SDK artifacts in HTML responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Datadog Browser RUM Real User Monitoring SDK artifacts in HTML responses.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Datadog Login Panel - Detect

Datadog login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Datadog login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Datadog Login Panel - Detect', 'description': 'Datadog...

GO-2026-6000 Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go

Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go...

aio-pika-rpc (1.1.0), datadog-lambda (0.10.0) potentially affected by CVE-2026-50271 via ddtrace (0.30.2)

ddtrace PYPI version 0.30.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - aio-pika-rpc 1.1.0 - datadog-lambda 0.10.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (2.14.0), ddtrace-aiomisc (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-50271 via ddtrace (0.31.0)

ddtrace PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda 2.14.0 - ddtrace-aiomisc =1.0.0, =1.0.2 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (2.16.0) potentially affected by CVE-2026-50271 via ddtrace (0.36.0)

ddtrace PYPI version 0.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda 2.16.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=2.19.0, <=2.21.0) potentially affected by CVE-2026-50271 via ddtrace (0.40.0)

ddtrace PYPI version 0.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =2.19.0, =2.21.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (2.24.0) potentially affected by CVE-2026-50271 via ddtrace (0.41.2)

ddtrace PYPI version 0.41.2 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda 2.24.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (2.26.0), pinecone-client (>=0.7.5, <=0.8.59) potentially affected by CVE-2026-50271 via ddtrace (0.44.0)

ddtrace PYPI version 0.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda 2.26.0 - pinecone-client =0.7.5, =0.8.59 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=2.27.0, <=3.31.0) potentially affected by CVE-2026-50271 via ddtrace (0.45.0)

ddtrace PYPI version 0.45.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =2.27.0, =3.31.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

opentelemetry-exporter-datadog (>=0.20.0b0, <=0.30.0b0) potentially affected by CVE-2026-50271 via ddtrace (0.46.0)

ddtrace PYPI version 0.46.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.20.0b0, =0.30.0b0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

datadog-lambda (>=3.33.0, <=3.41.0) potentially affected by CVE-2026-50271 via ddtrace (0.48.0)

ddtrace PYPI version 0.48.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - datadog-lambda =3.33.0, =3.41.0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...