This vulnerability exposes a configuration activity that was designed for widget setup but never properly decommissioned. When a user adds a Datadog widget to their home screen, the app launches a configuration activity to complete the setup flow. The flaw: this activity accepts a caller-supplied widget ID and automatically loads the user's stored session without any re-authentication, even when launched by an external app. An attacker with a co-installed malicious application can enumerate widget IDs (they're sequential integers) and hijack the victim's active Datadog session to query live infrastructure data.
Six different widget types share this identical vulnerability pattern, each exposing a different data domain: incidents, monitors, on-call schedules, SLOs, dashboards, and saved views. That six-fold replication is the real signal here — it wasn't one oversight but a structural failure to treat widget configuration as a shared security boundary. The activities were marked as exported, likely to handle edge cases where no deep-link resolved, but that fallback path received none of the authorization checks that should have applied.
The CVSS 5.5 severely understates this. The technical complexity is low, no special permissions are required beyond what any installed app holds, and the attacker gets direct access to whatever infrastructure data the victim's session can reach. The "co-installed malicious app" requirement is a real constraint but not a mitigation in environments with aggressive ad SDKs, sideloaded applications, or enterprise MDM tools.
What to check: confirm whether any of your fleet runs Datadog versions predating the fix (v545-5.9.2). On Android, review your MDM or EDR logs for any apps issuing Intents to Datadog widget configuration activities — that's your detection hook. The compensating control that should have existed (and apparently didn't) is either removing the exported flag from these activities post-setup or requiring a permission that only privileged system components hold. For your incident response posture, treat this as session hijacking: the attacker gains whatever data access the victim's session had, so your investigation should scope what that user could see.