CVE-2026-39196: Datadog, Inc Vector v0

Synopsis

SQL injection vulnerability in Datadog Vector v0.54.0 affects the KeyPartitioner::partition function via the set_uri_query parameter. The vulnerability is reachable over the network with no authentication required and no user interaction needed, making it exploitable by any remote party that can reach the service. Successful exploitation gives an attacker read and write access to the underlying database and can disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the service via a standard network connection to deliver a crafted request.

• AuthenticationNot required

  No credentials or prior account access are needed; the vulnerable parameter is reachable by unauthenticated requests.

• Victim interactionNot required

  Exploitation requires no action from any user or operator on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental factors are required.

Blast Radius

• Reads sensitive database records, including any data stored in tables accessible to the database user used by Vector.
• Modifies or deletes persisted database rows by injecting write or destructive SQL statements.
• Crashes or degrades the affected Vector service by injecting statements that exhaust database resources or cause fatal errors.
• Potentially pivots to other data sources reachable through the same database connection depending on granted privileges.