CVE-2026-116589: IAST % formatting error

CISO Take

Datadog's Python APM client (dd-trace-py) 3.13.0 through 4.15.4 has an unhandled-error flaw in its IAST string instrumentation: when old-style % formatting runs on attacker-controlled input, the error can terminate the whole Python process. The exposure is narrow, because it requires IAST to be explicitly enabled (not the default) and application code that applies the affected formatting operation to untrusted input. Even so, a crash in an AI service, such as an inference API, agent backend or RAG gateway, is a clean availability hit. No public exploit, Nuclei template or KEV listing exists, and no EPSS score is published yet, so this is a patch-in-cycle item rather than an emergency. Upgrade to dd-trace-py 4.15.5, and prioritize internet-facing services that run IAST and format user input with % strings.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Severity is rated high, but no CVSS vector or EPSS score is available, so exploitability is not quantified. Real-world risk is limited by two preconditions: IAST must be enabled (non-default) and application code must pass attacker-controlled input through % formatting. Impact is limited to availability (CWE-248, uncaught exception). There is no indication of confidentiality or integrity impact. Risk is higher for single-process or low-redundancy AI services where one crash drops all in-flight work. Confidence: MEDIUM, since vector details are missing.

How does the attack unfold?

Initial Access

Attacker sends crafted input to an exposed AI service running dd-trace-py with IAST enabled.

AML.T0049

Exploitation

Input reaches old-style % string formatting and the IAST instrumentation raises an unhandled internal error.

Impact

The Python process terminates, interrupting in-flight inference or agent work and denying service.

AML.T0029

Initial Access

Attacker sends crafted input to an exposed AI service running dd-trace-py with IAST enabled.

AML.T0049

Exploitation

Input reaches old-style % string formatting and the IAST instrumentation raises an unhandled internal error.

Impact

The Python process terminates, interrupting in-flight inference or agent work and denying service.

AML.T0029

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade ddtrace (dd-trace-py) to 4.15.5 or later in all environments, including container base images and lockfiles. 2) If patching is delayed, disable IAST (for example DD_IAST_ENABLED=false) on exposed services. 3) Inventory services running ddtrace 3.13.0 to 4.15.4 with IAST on, using SBOM or pip freeze plus environment configuration review. 4) Monitor for unexpected Python process exits, crash loops or OOM/restart spikes correlated with specific request payloads. 5) Ensure orchestration (Kubernetes restart policies, replicas, health checks) limits blast radius of single-process crashes. 6) Review the vendor advisory GHSA-p3m5-h5v9-vqj6 and fix PRs 20786 and 20823.

How is it classified?

DoSFrameworkAPIAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party AI/software components

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-116589?

Datadog's Python APM client (dd-trace-py) 3.13.0 through 4.15.4 has an unhandled-error flaw in its IAST string instrumentation: when old-style % formatting runs on attacker-controlled input, the error can terminate the whole Python process. The exposure is narrow, because it requires IAST to be explicitly enabled (not the default) and application code that applies the affected formatting operation to untrusted input. Even so, a crash in an AI service, such as an inference API, agent backend or RAG gateway, is a clean availability hit. No public exploit, Nuclei template or KEV listing exists, and no EPSS score is published yet, so this is a patch-in-cycle item rather than an emergency. Upgrade to dd-trace-py 4.15.5, and prioritize internet-facing services that run IAST and format user input with % strings.

Is CVE-2026-116589 actively exploited?

No confirmed active exploitation of CVE-2026-116589 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116589?

1) Upgrade ddtrace (dd-trace-py) to 4.15.5 or later in all environments, including container base images and lockfiles. 2) If patching is delayed, disable IAST (for example DD_IAST_ENABLED=false) on exposed services. 3) Inventory services running ddtrace 3.13.0 to 4.15.4 with IAST on, using SBOM or pip freeze plus environment configuration review. 4) Monitor for unexpected Python process exits, crash loops or OOM/restart spikes correlated with specific request payloads. 5) Ensure orchestration (Kubernetes restart policies, replicas, health checks) limits blast radius of single-process crashes. 6) Review the vendor advisory GHSA-p3m5-h5v9-vqj6 and fix PRs 20786 and 20823.

What systems are affected by CVE-2026-116589?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Agent frameworks, RAG pipelines, LLM API gateways, Application observability and security instrumentation.

What is the CVSS score for CVE-2026-116589?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Model servingAgent frameworksRAG pipelinesLLM API gatewaysApplication observability and security instrumentation

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.

Exploitation Scenario

An adversary identifies an internet-facing LLM gateway or agent API that runs Datadog IAST in production. They send crafted prompts or request fields that the application embeds into log or message strings via old-style % formatting. The IAST instrumentation raises an unhandled internal error and the Python worker terminates. By repeating the request, the attacker keeps workers down and degrades or denies the AI service to legitimate users.