SQL Injection in Datadog Vector

Executive Summary

CVE-2026-39196 is a SQL injection vulnerability found in Datadog Vector version 0.54.0, specifically in the ClickHouse sink component. The issue occurs because the database identifier used in SQL INSERT queries is not properly escaped when it is dynamically generated from event fields. An attacker who controls an event field, such as the target database name, can inject malicious SQL formatting commands to manipulate the query. This allows them to redirect writes to unintended ClickHouse tables by breaking out of the quoted context in the SQL statement.

For example, by crafting a field like `prod"."admin_logs" FORMAT JSONEachRow --`, an attacker can alter the query to write data into the `prod.admin_logs` table instead of the intended one. This vulnerability arises because URL encoding does not prevent the attack, as ClickHouse decodes the query before parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to perform data integrity attacks on your ClickHouse database. Specifically, attackers can inject logs into unauthorized tables, pollute audit data, or manipulate downstream monitoring workflows.

Such unauthorized writes can compromise the reliability and trustworthiness of your data, potentially leading to incorrect monitoring alerts, corrupted audit trails, and unauthorized data manipulation, assuming the Vector service has write permissions to the targeted tables.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves SQL injection via the set_uri_query parameter in the KeyPartitioner::partition function, specifically affecting Datadog Vector version 0.54.0 when using dynamic database templates in the ClickHouse sink configuration.

To detect exploitation attempts on your system, you should monitor logs and events for suspicious or malformed SQL queries targeting ClickHouse tables, especially those containing unusual formatting or injection patterns such as escaped quotes or injected SQL commands.

You can use commands to search for suspicious queries or payloads in your logs. For example, using grep on log files to find suspicious patterns:

• grep -r '"\.\"admin_logs\" FORMAT JSONEachRow --' /path/to/vector/logs
• grep -r 'target_db' /path/to/vector/logs | grep -E '"\.\".*\" FORMAT JSONEachRow --'

Additionally, monitoring network traffic for unusual SQL queries or unexpected writes to unauthorized ClickHouse tables can help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Avoid using dynamic database templates in the ClickHouse sink configuration that incorporate untrusted event fields.
• Sanitize and properly escape all user-controlled inputs used in SQL queries to prevent injection.
• Restrict Vector service write permissions to only necessary ClickHouse tables to limit potential damage.
• Monitor logs and audit trails for suspicious activity or unexpected writes to unauthorized tables.
• Update or patch Datadog Vector to a version where this vulnerability is fixed once available.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in Datadog Vector v0.54.0 allows attackers to manipulate database queries and redirect writes to unauthorized ClickHouse tables. This can lead to data integrity attacks, including injecting logs into unauthorized tables and polluting audit data.

Such manipulation of audit data and unauthorized access or alteration of sensitive information can undermine compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data integrity, confidentiality, and auditability.

Useful 0 Not Useful 0