CVE-2026-44964
Received Received - Intake

Datadog Android App Activity Spoofing Vulnerability

Publication date: 2026-08-07

Last updated on: 2026-08-08

Assigner: HackerOne

Description
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process. This requires: A malicious application co-installed on the victim's device. An active Datadog session in the Android app. Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-08
Generated
2026-08-28
AI Q&A
2026-08-07
EPSS Evaluated
2026-08-26
NVD
CVE-2026-44964
EUVD
EUVD-2026-54570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datadog android_application *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Datadog Android app involves an exported activity (OnCallNotificationActivity) without permission restrictions. A malicious co-installed app can launch this activity with attacker-controlled inputs, triggering forged requests to Datadog's backend, launching unintended activities via the confused-deputy pattern, and waking the device screen for social engineering or annoyance attacks.

Detection Guidance

This vulnerability is specific to the Datadog Android application and requires detecting improperly configured exported activities. Check the AndroidManifest.xml for activities with android:exported="true" and no permission guards. Use the command: adb shell dumpsys package com.datadog.app | grep -A 10 "android:exported"

Impact Analysis

If exploited, this flaw could allow unauthorized acknowledgment of on-call pages using your authenticated session, potentially disrupting operations. It may also enable attackers to launch hidden activities within Datadog's app, bypassing security controls and using your device screen for phishing or harassment.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to user data or system controls. The confused-deputy pattern allows a malicious app to trigger actions in the Datadog app without proper authentication, risking exposure of sensitive user information or system states. This could lead to unauthorized data processing or disclosure, conflicting with GDPR's data protection principles and HIPAA's access control requirements.

Mitigation Strategies

Update the Datadog Android application to the latest version where this issue is patched. If no patch is available, restrict installation of untrusted applications on the device. Disable the Datadog app's lock-screen permissions if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart