EUVD-2026-54569
GHSA-9pjj-6mjx-mcc6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
C:L not C:H because disclosure recipient is Google (a legitimate third-party service), not an arbitrary attacker; no email, name, credentials, or organizational data is confirmed exposed.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
4DescriptionCVE.org
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID - a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.
AnalysisAI
Datadog Android app versions prior to 5.9.2 structurally associate authenticated users' Datadog UUIDs with Google Firebase Installation IDs on every successful login, transmitting this stable cross-session identifier - alongside crash stack traces that may include in-flight application data, internal class names, package names, and breadcrumbs - to Google's Firebase Crashlytics backend without an identifiable user consent gate or opt-out mechanism. The exposure is not triggered by an external attacker but occurs automatically during normal authenticated app usage for all affected users. No active exploitation has been identified (SSVC Exploitation: none; no CISA KEV listing), and no public exploit code exists; the primary risk is regulatory and privacy-related rather than direct technical compromise.
Technical ContextAI
The Datadog Android SDK integrates Firebase Crashlytics - Google's crash-reporting service - via two SDK calls: setUserId() and recordException(). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) governs the root cause: the Datadog user UUID, a stable per-user identifier meaningful within the Datadog observability platform, is passed to setUserId() at every login event, permanently linking it to the device-scoped Firebase Installation ID on Google's backend infrastructure. When uncaught exceptions subsequently occur, recordException() forwards crash reports to Firebase Crashlytics attributed to that same UUID. These reports may carry Java/Kotlin class names, package names, heap-referenced object data present at crash time, and any Crashlytics breadcrumb events logged before the crash - all associated with the linked user identity. The Firebase documentation cited in the CVE references confirms that Crashlytics supports an opt-in reporting model (customizable consent gate), which was not implemented in the affected Datadog code paths. No CPE strings are included in the source data; the affected artifact is the official Datadog Android app.
RemediationAI
Update the Datadog Android application to version 5.9.2 or later, which is the remediated release per EUVD-2026-54569 and the Datadog Trust Center advisory at trust.datadoghq.com. For organizations unable to update immediately, consider restricting or disabling use of the Datadog Android mobile app through mobile device management (MDM) policy until the patch is deployed - this eliminates the exposure entirely but removes mobile observability access for affected users. As a network-level compensating control, MDM or firewall rules can block outbound traffic from the Datadog Android app to Firebase Crashlytics endpoints (app-measurement.com, firebase-settings.crashlytics.com, and related *.crashlytics.com domains), though this breaks crash-reporting functionality and may cause secondary failures if the app has dependencies on Firebase initialization. The Firebase opt-in reporting pattern documented at firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#enable-opt-in-reporting represents the correct architectural fix applied in 5.9.2.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today