CVE-2026-47362
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Datadog Android app versions prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history).
Risk Assessment
Any actor able to bypass the app sandbox can read these databases in plaintext, leading to exposure of sensitive user information such as notification content and search history.
Recommendation
Update the Datadog Android app to version v554-5.9.4 or later, which includes the security fix.
Original NVD description (English source)
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). Impact: Any actor able to bypass the app sandbox can read these databases in plaintext.