CRE-2025-0034

Datadog agent disabled due to missing API keyMedium

Impact: 6/10

Mitigation: 2/10

CRE-2025-0034View on GitHub

DatadogConfigurationApi KeyObservabilityEnvironmentTelemetryKnown IssuePublic

Description

If the Datadog agent or client libraries do not detect a configured API key, they will skip sending metrics, logs, and events. This results in a silent failure of observability reporting, often visible only through startup log messages.

Cause

The environment variable `DD_API_KEY` was not set, or was set to an empty value in the container or application environment. As a result, the Datadog agent or SDK initializes in a no-op mode and skips exporting telemetry.

Mitigation

• Ensure that the `DD_API_KEY` environment variable is present and correctly populated in the container or deployment spec.
• Use Kubernetes secrets or external secret stores to safely inject credentials into the runtime environment.
• Verify that the variable is readable by the process and not masked by entrypoint logic or shell scope.

References

• https://docs.datadoghq.com/agent/guide/agent-configuration-files/?tab=linux#api-key
• https://docs.datadoghq.com/getting_started/site/