CVE-2026-47362

Received Received - Intake

Datadog Android App Stores Sensitive Data in Plaintext SQLite

Publication date: 2026-08-07

Last updated on: 2026-08-08

Assigner: HackerOne

Description

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-08

Generated

2026-08-28

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-47362

EUVD

EUVD-2026-54566

Affected Vendors & Products

Vendor	Product	Version / Range
zetetic	sqlcipher	android

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-922	The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Attack-Flow Graph

Executive Summary

The Datadog Android app stores sensitive data like notifications, search queries, and incident details in plaintext SQLite databases. These databases lack encryption and rely only on Android's default sandbox protection. Attackers with physical access, root access, or misconfigured backups could extract this data.

Detection Guidance

Check for plaintext SQLite databases in /data/data/com.datadog.app/databases/ on Android devices. Look for files like LocalNotificationDatabase and SearchRecentDatabase. Verify if encryption is enabled by searching for SQLCipher or Room encryption configurations in the app's codebase.

Impact Analysis

If exploited, attackers could access operational metadata such as customer infrastructure details, incident recipients, or search queries revealing internal service names. This could lead to data breaches, unauthorized monitoring, or targeted attacks on your systems.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to inadequate protection of sensitive personal and health data. GDPR requires encryption for personal data, while HIPAA mandates safeguards for protected health information. Plaintext storage increases non-compliance risk.

Mitigation Strategies

Migrate databases to SQLCipher by integrating it into the app. Add SQLCipher dependencies, initialize encryption with a license, and update database connections. Ensure proper access controls and disable allowBackup if misconfigured.

Hi! I’m here to help you understand CVE-2026-47362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70