CVE-2026-116589

Description

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.

Is your site exposed to CVE-2026-116589?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-248 CWE-248

References

Other References

https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7 https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69 https://github.com/DataDog/dd-trace-py/pull/20786 https://github.com/DataDog/dd-trace-py/pull/20823 https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5 https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6

Frequently Asked Questions

What is CVE-2026-116589? +

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.

How do I check if I'm vulnerable to CVE-2026-116589? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-46689

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a …

CVE-2026-54908

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial …

CVE-2025-53366

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to …

CVE-2025-53365

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to …

CVE-2025-53620

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing …

CVE-2026-55780

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in …