CVE-2026-47362
Received Received - Intake

Datadog Android App Stores Sensitive Data in Plaintext SQLite

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-47362
EUVD
EUVD-2026-54566

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zetetic sqlcipher android

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-922 The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Datadog Android app stores sensitive data like notifications, search queries, and incident details in plaintext SQLite databases. These databases lack encryption and rely only on Android's default sandbox protection. Attackers with physical access, root access, or misconfigured backups could extract this data.

Detection Guidance

Check for plaintext SQLite databases in /data/data/com.datadog.app/databases/ on Android devices. Look for files like LocalNotificationDatabase and SearchRecentDatabase. Verify if encryption is enabled by searching for SQLCipher or Room encryption configurations in the app's codebase.

Impact Analysis

If exploited, attackers could access operational metadata such as customer infrastructure details, incident recipients, or search queries revealing internal service names. This could lead to data breaches, unauthorized monitoring, or targeted attacks on your systems.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to inadequate protection of sensitive personal and health data. GDPR requires encryption for personal data, while HIPAA mandates safeguards for protected health information. Plaintext storage increases non-compliance risk.

Mitigation Strategies

Migrate databases to SQLCipher by integrating it into the app. Add SQLCipher dependencies, initialize encryption with a license, and update database connections. Ensure proper access controls and disable allowBackup if misconfigured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart