In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00251.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://cwe.mitre.org/data/definitions/200.html cve-icon
https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#enable-opt-in-reporting cve-icon
https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef cve-icon
History

Sat, 08 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Datadog Android App Sends Stable User Identifier to Firebase Crashlytics

Sat, 08 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 08 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Description On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths. In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.

Fri, 07 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Datadog Android App Sends Stable User Identifier to Firebase Crashlytics

Fri, 07 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's Datadog UUID — a stable per-user identifier that is meaningful inside Datadog. This associates the Datadog user UUID with the device's Firebase installation ID on Google's backend. Separately, uncaught exceptions are forwarded to Firebase Crashlytics via recordException, attaching stack traces (which may include internal class names, package names, in-flight data referenced by crash frames, and any breadcrumbs) to the same user UUID. No visible consent gate or opt-out for Crashlytics tagging was identified in the reviewed code paths. No email, name, or organization data is forwarded to Crashlytics in the reviewed paths.
Weaknesses CWE-200
References
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-08-08T01:05:53.273Z

Reserved: 2026-05-19T15:00:09.319Z

Link: CVE-2026-47364

cve-icon Vulnrichment

Updated: 2026-08-07T18:34:50.582Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T04:00:04Z