CVE-2026-47364

Received Received - Intake

Datadog Android App Crashlytics User UUID Exposure

Publication date: 2026-08-07

Last updated on: 2026-08-08

Assigner: HackerOne

Description

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-08

Generated

2026-08-28

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-47364

EUVD

EUVD-2026-54569

Affected Vendors & Products

Vendor	Product	Version / Range
datadog	android_application	*
google	firebase_crashlytics	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Datadog Android app sends a stable per-user Datadog UUID to Firebase Crashlytics on login, linking it to the device's Firebase installation ID. Uncaught exceptions are then reported to Crashlytics with stack traces that may include internal details like class names or breadcrumbs, all tied to the same UUID. No consent or opt-out mechanism for this tagging was found in the reviewed code paths.

Detection Guidance

This vulnerability involves potential exposure of Datadog UUIDs and crash data via Firebase Crashlytics. To detect it, inspect network traffic for outbound connections to Firebase Crashlytics endpoints (e.g., firebasecrashlytics.googleapis.com). Check app logs for Crashlytics-related entries or user UUID transmissions. Use tools like Wireshark or tcpdump to monitor traffic, and logcat for Android app logs.

Impact Analysis

This vulnerability could expose internal app details (e.g., crash stack traces, class names) to Crashlytics, potentially revealing sensitive operational data. While no direct personal data like email or name is sent, the UUID could still link crash reports to a specific user, raising privacy concerns.

Compliance Impact

The vulnerability may violate GDPR by processing user-identifiable crash data without explicit consent. For HIPAA, if the app handles health data, exposing internal crash details could risk unauthorized disclosure of protected information. Compliance hinges on whether the UUID and crash data qualify as personal or sensitive data under these regulations.

Mitigation Strategies

Disable Firebase Crashlytics reporting in the Datadog Android app if possible. Review app permissions to limit data collection. Update the app to a patched version if available. Consider using network monitoring to block unauthorized Crashlytics traffic.

Hi! I’m here to help you understand CVE-2026-47364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70