Live › vulnerability › CVE-2026-116589
Go to dashboardThe Datadog Python APM client (dd-trace-py) versions 3.13.0 through 4.15.4 mishandle internal errors in its IAST string-formatting instrumentation. Attacker-controlled input passed through old-style % formatting can terminate the Python process and interrupt its work.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Only applications that run dd-trace-py in the affected range with IAST turned on, and whose code applies % string formatting to attacker-controlled input. IAST is not on by default, so deployments with it off are not exposed by this issue.
No product ranges from the sources yet.
pip show ddtrace and check whether the version is between 3.13.0 and 4.15.4.DD_IAST_ENABLED environment variable set to true.ddtrace to 4.15.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-116589")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.