EUVD-2026-54570
GHSA-jcqx-89jm-9vxr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Co-installed app required so AV:L; no Android permissions needed so PR:N; one tap required so UI:R; confused deputy reaches non-exported components so S:C; forged Acknowledge is high integrity impact (I:H); no availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
4DescriptionCVE.org
The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest.xml with no permission guard. Any co-installed application on the same device can launch it with attacker-controlled Intent extras: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker), and on_call_page_intent, a Parcelable Intent that is passed through to startActivity from inside the Datadog process after a single user tap on the Acknowledge button. The activity enables lock-screen display (setShowWhenLocked) and wakes the device (setTurnScreenOn) on launch. After one user tap, three effects follow: (1) a forged Acknowledge request is sent to the Datadog backend for the attacker-chosen page_id using the victim's authenticated session; (2) the attacker-controlled Intent is launched from the Datadog process via startActivity, providing reach into non-exported components of com.datadog.app (confused-deputy pattern); (3) the keyguard is dismissed and the screen turned on, usable as a social-engineering or annoyance vector. Preconditions: a malicious application co-installed on the victim device and an active Datadog session in the Android app.
AnalysisAI
Forged on-call acknowledgment and confused-deputy execution in the Datadog Android application (versions prior to 5.9.2) allows any co-installed malicious app to silently dismiss real production incident alerts on behalf of the victim by exploiting an unguarded exported Activity with no permission check. An attacker-controlled app can supply crafted Intent extras to forge a backend Acknowledge API call using the victim's authenticated session, redirect the Datadog process into non-exported internal components, and surface a spoofed alert over the device lock screen. No public exploit has been identified at time of analysis; exploitation requires a malicious co-installed app plus a single user tap.
Technical ContextAI
The vulnerability resides in OnCallNotificationActivity, which is declared android:exported="true" in AndroidManifest.xml without any android:permission attribute - violating the Android activity export security model documented at developer.android.com/guide/topics/manifest/activity-element#exported. This exposes the Activity to any installed app on the device, not just the system or Datadog itself. The root cause class is CWE-441 (Unintended Proxy or Intermediary / Confused Deputy): the exported Activity acts as a privileged proxy that bridges an untrusted caller (malicious co-installed app) to privileged Datadog internals, including an authenticated backend API call and startActivity invocations targeting non-exported com.datadog.app components. Three attacker-controlled Intent extras drive the exploit: on_call_page_content (rendered as full-screen lock-screen text), page_id (used to enqueue an on-call Acknowledge worker against the Datadog backend), and on_call_page_intent (a Parcelable Intent that the Datadog process forwards via startActivity after one user tap). The Activity also invokes setShowWhenLocked and setTurnScreenOn, granting it the ability to surface over the device lock screen and dismiss the keyguard. No CPE strings were provided in the source data; affected scope is the Datadog Android mobile application only.
RemediationAI
Update the Datadog Android application to version 5.9.2 or later, which EUVD-2026-54570 identifies as the remediated release; verify fix details (expected to involve removing the unconditional android:exported="true" or adding an android:permission guard on OnCallNotificationActivity) via the vendor advisory at https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef. Until patching is possible, enforce MDM policies to allowlist which applications may be installed alongside Datadog on managed devices - this directly eliminates the co-installation prerequisite, though it imposes app management overhead. Disabling sideloading and enforcing Google Play Protect reduces the risk surface but cannot eliminate installation of malicious apps distributed through official channels. No network-level or server-side mitigations are effective since exploitation is entirely device-local and uses the victim's own authenticated session.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today