Description

The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two databases were reviewed: LocalNotificationDatabase (table local_notifications, columns including title, message, recipient, service, tags, and on-call/incident deeplinks) and SearchRecentDatabase (table search_recents, storing every in-app search query the user typed). A repository-wide search for SQLCipher, SupportFactory, openHelperFactory, or any Room encryption configuration returns no matches. Databases are stored as cleartext SQLite files in /data/data/com.datadog.app/databases/. At-rest protection therefore depends solely on the Android application sandbox — the standard Android baseline, adequate for many applications but flagged here as a hardening recommendation because the stored content is operationally sensitive (customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries that may reveal service names, dashboards, and queries of interest). Exploitation paths include rooted or jailbroken devices, adb backup if android:allowBackup is misconfigured for any build flavor, physical-device handover scenarios, and forensic acquisition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-07T18:17:15.887Z",
  "pubdate": "2026-08-07T18:17:15.887Z",
  "executiveSummary": "The Datadog Android application suffers from sensitive data exposure due to storing operational data in plaintext SQLite databases without encryption at rest. The vulnerability impacts the LocalNotificationDatabase and SearchRecentDatabase components within the application sandbox. The risk implications include the potential disclosure of operationally sensitive content, such as customer infrastructure monitoring metadata, incident notification recipients, and free-text search queries revealing service names, dashboards, and queries of interest. Attackers with root access, physical device possession, forensic acquisition capabilities, or exploiting misconfigured backup settings can extract cleartext database files directly from the device storage. Exploitation requires local access to the device or sandbox compromise vectors, bypassing the standard Android application sandbox protections that serve as the sole defense mechanism in the absence of application-layer database encryption.",
  "technicalDetails": "The root cause of the vulnerability is the absence of database-level encryption mechanisms, such as SQLCipher, SupportFactory, or openHelperFactory, within the Room persistence library configuration. The vulnerable components are the LocalNotificationDatabase and SearchRecentDatabase databases stored within the application private directory at /data/data/com.datadog.app/databases/. The LocalNotificationDatabase stores the local_notifications table, containing operational parameters including titles, messages, recipients, services, tags, and on-call or incident deeplinks. The SearchRecentDatabase stores the search_recents table, which logs every in-app search query typed by the user.\nExploitation occurs via local attack vectors where an adversary leverages elevated privileges, forensic tooling, or backup extraction techniques. The attack flow begins with gaining access to the device file system through a rooted or jailbroken environment, physical-device handover, or exploitation of adb backup functionality if android:allowBackup is improperly configured for specific build flavors. Once file system access is achieved, the adversary navigates to the application data directory (/data/data/com.datadog.app/databases/) and copies the cleartext SQLite database files to an external system. Because the databases lack encryption at rest, the adversary can immediately query, parse, and analyze the raw SQLite files using standard database management tools to extract sensitive monitoring metadata, infrastructure details, and proprietary search histories without requiring authentication or authorization bypasses beyond initial device access."
}