{"id":"CVE-2026-47364","aliases":["EUVD-2026-54569","GHSA-9pjj-6mjx-mcc6"],"status":"published","title":"On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId...","description":"In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00438,"percentile":0.38538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-08-07T18:02:35Z","modified":"2026-10-23T20:10:00Z","products":[{"vendor":"datadog","product":"android app"},{"vendor":"yoel geva","product":"android app"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/200.html"},{"url":"https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#enable-opt-in-reporting"},{"url":"https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47364"},{"url":"https://github.com/advisories/GHSA-9pjj-6mjx-mcc6"}],"sources":{"cve":[{"id":"CVE-2026-47364","description":"In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.","status":"published","published":"2026-08-07T18:02:35.142Z","modified":"2026-08-08T01:05:53.273Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-54569","description":"In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.","status":"published","published":"2026-08-07T18:02:35Z","modified":"2026-08-08T01:05:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-9pjj-6mjx-mcc6","title":"On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId...","description":"On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID.\nNo visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.","status":"published","published":"2026-08-07T18:31:46Z","modified":"2026-08-07T21:31:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:10:12.306859Z"}],"nvd":[{"id":"CVE-2026-47364","description":"In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.","status":"published","published":"2026-08-07T18:17:17.217Z","modified":"2026-10-23T20:10:00.16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:35.386166Z"}]}}