datadog-agent

Agent

[!WARNING] Kubernetes installations: This Agent version may drop configuration settings in the trace-agent, process-agent, security-agent, and system-probe containers. As a result, these containers may crash, stop reporting data, or ignore configured settings

Recommended action: Upgrade to Agent 7.85.2.

Prelude

Released on: 2026-11-04

• Please refer to the 7.85.1 tag on integrations-core for the list of changes on the Core Checks

Bug Fixes

• CSPM: On hosts in FIPS mode, oscap-io aborted before its first rule with "out of core in secure memory" wherever it could not lock memory, as in system-probe, whose seccomp profile denies mlock. It now evaluates the XCCDF rules there.
• CSPM: The Agent removes the temporary files of each oscap-io process once it exits. An oscap-io process that crashed or was killed left an oscap.* directory in /tmp, which on FIPS hosts filled /tmp.
• Fix a crash on startup of the 32-bit ARM IoT Agent when logs collection is enabled (unaligned 64-bit atomic operation). See #59066.

Datadog Cluster Agent

Prelude

Released on: 2026-11-04 Pinned to datadog-agent v7.85.1: CHANGELOG.

Agent

[!WARNING] Kubernetes installations: This Agent version may drop configuration settings in the trace-agent, process-agent, security-agent, and system-probe containers. As a result, these containers may crash, stop reporting data, or ignore configured settings

Recommended action: Upgrade to Agent 7.85.2.

Prelude

Released on: 2026-10-30

• Please refer to the 7.85.0 tag on integrations-core for the list of changes on the Core Checks

Upgrade Notes

• For the Oracle integration, the minimum supported version of an externally installed Oracle client is now Oracle 19c. This applies to instances configured with oracle_client: true (or its deprecated aliases instant_client: true and use_instant_client: true), as well as instances that set tns_admin or tns_alias, which also require an external Oracle client. Upgrade the Oracle client on hosts running the Agent to at least version 19c before upgrading the Agent.

• On Windows, dd-procmgr-service is now installed and configured to run as LocalSystem instead of the Agent user account. The installer no longer disables the service when DDAGENTUSER_PASSWORD is omitted on upgrade.

• The 75 deprecated CIS Kubernetes 1.5.1 rules scoped to Kubernetes nodes are no longer shipped or evaluated, and stop producing findings. They covered control plane and worker node file permissions and ownership, and the command line flags of kube-apiserver, kube-controller-manager, kube-scheduler, etcd, kube-proxy and kubelet (controls 1.1.x, 1.2.x, 1.3.x, 1.4.x, 2.x, 3.2.1, 4.1.x and 4.2.x). They were marked deprecated in March 2024 and reported skipped on EKS, GKE and AKS, where the control plane files they read are not present on the node.

  Kubernetes node posture is now evaluated from the node configuration the Agent exports as a kubernetes_master_node, kubernetes_worker_node, aws_eks_worker_node, gcp_gke_worker_node or azure_aks_worker_node resource, against the CIS Kubernetes 1.9.0, CIS Amazon EKS, CIS GKE and CIS AKS benchmarks. Dashboards, monitors and suppressions keyed on a cis-kubernetes-1.5.1-* rule ID need to be repointed at the equivalent rule in those benchmarks.

• AWS Lambda MicroVM lifecycle and heartbeat metrics now use the aws.lambda.microvm.enhanced.* namespace instead of aws.lambda.enhanced.microvm.*. Update any dashboards, monitors, or metric queries that use the previous names.

New Features

• Added k8seventsreceiver, kafkareceiver, and httpcheckreceiver receivers, and deltatorateprocessor processor to the Datadog OpenTelemetry Collector (DDOT) manifest, enabling collection of Kubernetes events, telemetry transported over Kafka topics, HTTP health check status, and delta-to-rate metric conversion in standalone DDOT deployments.

• Add a Private Action Runner action that creates a compressed DogStatsD context dump in the Agent's runtime directory and returns its path for subsequent remote diagnostics.

• Add a gpu_mig_profile tag to GPU metrics. On a MIG instance it carries the NVIDIA MIG profile name of the device's GPU instance, lowercased, with + written as _ (1g.35gb, 1g.24gb_me, 1g.24gb-me, 4g.96gb_gfx), for every MIG instance regardless of how it was allocated (DRA, device plugin, or idle). Like the other device tags it is set on every GPU: devices that are not MIG instances, including MIG-enabled physical cards, carry none. The profile is read from the device's own NVML name and needs no additional privileges. On drivers whose device names do not carry it, the agent falls back to the GPU instance handle, which requires a privileged agent; if that is unavailable the value is unknown and the reason is logged.

• The Agent now reports the state of each process it supervises (starting, running, crashed, failed, and so o

Agent

Prelude

Released on: 2026-10-23

• Please refer to the 7.84.6 tag on integrations-core for the list of changes on the Core Checks

Security Notes

• The embedded Python interpreter now rejects TLS certificate chains that contain one of the compromised eMudhra intermediate CA keys, whichever trust store the chain anchors in. This backports the CPython fix for CVE-2026-115557. On Windows, Python checks no longer trust these chains through the Windows certificate store.

Datadog Cluster Agent

Prelude

Released on: 2026-10-23 Pinned to datadog-agent v7.84.6: CHANGELOG.

Agent

Prelude

Release on: 2026-10-22

• Please refer to the 6.53.2 tag on integrations-core for the list of changes on the Core Checks

Security Notes

• Update the embedded CA certificate bundle to the Mozilla bundle dated 2026-10-20. This removes the emSign ECC Root CA - G3, emSign ECC Root CA - C3 and emSign Root CA - C1 root certificates, which Mozilla removed from its root store. The CA bundles vendored by the certifi, pip, boto and botocore Python packages are replaced with this bundle as well.

Bug Fixes

• Stop chunking outputs in manual checks for container, process, and process_discovery checks to allow JSON unmarshaler to parse output.

Datadog Cluster Agent

Prelude

Released on: 2026-10-22 Pinned to datadog-agent v6.53.2: CHANGELOG.