CVE-2025-61667 - CVE House
Back to Database
Status published High CVE-2025-61667

Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions

Vulnerability Description

The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this directory is only run by the Agent during Agent install/upgrades. This could allow an attacker with local access to modify files in this directory, which would then subsequently be run when the Agent is upgraded, resulting in local privilege escalation. This issue requires local access to the host and a valid low privilege account to be vulnerable. Note that this vulnerability only impacts the Linux Host Agent. Other variations of the Agent including the container, kubernetes, windows host and other agents are not impacted. Version 7.71.0 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61667

Credits & Attribution

No credits recorded in the NVD database.

References

More from DataDog

View All →
CVE-2024-38525
dd-trace-cpp malformed unicode header values may cause crash
High 7.5
CVE-2023-38704
import-in-the-middle allows unsanitized user controlled input in module generation
High 8.1
CVE-2022-23531
Arbitrary file write when scanning a specially-crafted local PyPI package
Medium 5.8
CVE-2022-23530
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
Medium 5.8
CVE-2021-21331
DataDog API Client contains a Local Information Disclosure Vulnerability
Low 3

Affected Vendor

Affected Software

datadog-agent
Vulnerable Versions:
>= 7.65.0 , < 7.71.0

Timeline

Official Publish: November 12th, 2025
Last Modified: November 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-276

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification
Defense Evasion
T1078 Valid Accounts
Persistence
T1574 Hijack Execution Flow
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1005 Data from Local System
Collection