CVE-2026-116589
Datadog dd-trace-py is the Datadog Python APM client
- Risk score
- 64/100
- CVSS
- 8.2 v4.0
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.15.5 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: python
References
- https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7
- https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69
- https://github.com/DataDog/dd-trace-py/pull/20786
- https://github.com/DataDog/dd-trace-py/pull/20823
- https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5
- https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6
Original description
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.
Last activity 26 Oct 2026. Patch Forecast updates every hour.