{"id":"CVE-2026-47362","aliases":["EUVD-2026-54566","GHSA-98h7-6m49-37qg"],"status":"published","title":"The Datadog Android application stores operationally sensitive content in plaintext SQLite...","description":"In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). \r\nImpact: Any actor able to bypass the app sandbox can read these databases in plaintext.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00244,"percentile":0.15736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-922"],"published":"2026-08-07T18:02:34Z","modified":"2026-10-23T20:10:00Z","products":[{"vendor":"datadog","product":"android app"},{"vendor":"yoel geva","product":"android app"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/922.html"},{"url":"https://www.zetetic.net/sqlcipher/sqlcipher-for-android/"},{"url":"https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47362"},{"url":"https://www.zetetic.net/sqlcipher/sqlcipher-for-android"},{"url":"https://github.com/advisories/GHSA-98h7-6m49-37qg"}],"sources":{"cve":[{"id":"CVE-2026-47362","description":"In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). \r\nImpact: Any actor able to bypass the app sandbox can read these databases in plaintext.","status":"published","published":"2026-08-07T18:02:34.902Z","modified":"2026-08-08T01:05:53.195Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-54566","description":"In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). \r\nImpact: Any actor able to bypass the app sandbox can read these databases in plaintext.","status":"published","published":"2026-08-07T18:02:34Z","modified":"2026-08-08T01:05:53Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-98h7-6m49-37qg","title":"The Datadog Android application stores operationally sensitive content in plaintext SQLite...","description":"The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed).\nA repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest).\nExploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.","status":"published","published":"2026-08-07T18:31:46Z","modified":"2026-08-07T21:30:37Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T15:10:12.306859Z"}],"nvd":[{"id":"CVE-2026-47362","description":"In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). \r\nImpact: Any actor able to bypass the app sandbox can read these databases in plaintext.","status":"published","published":"2026-08-07T18:17:15.887Z","modified":"2026-10-23T20:10:00.16Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:12:35.386166Z"}]}}