Unauthenticated access to shared dashboards via public URLs
0 reputation · 28 Jan 2023, 09:05 UTC
Datadog allows dashboards to be shared using a public URL, enabling users to view metrics and visualizations without authenticating into the platform. While this facilitates external reporting, it introduces a risk where sensitive metric names, host tags, or infrastructure data are exposed to anyone possessing the link.
Organization administrators can mitigate this by disabling the Public Sharing toggle within Organization Settings. However, there is uncertainty regarding the lifecycle of links generated before a global policy change is implemented and whether these links remain active or are immediately invalidated upon disabling the feature.
- Does disabling the global public sharing setting retroactively revoke access to all previously generated public dashboard URLs?
- Is there a mechanism to audit all currently active public links across an organization without manually checking every dashboard?