4vulnerabilities
- Critical0 (0.0%)
- High1 (25.0%)
- Medium0 (0.0%)
- Moderate2 (50.0%)
- Low1 (25.0%)
dynatrace-oss-dynatrace-mcp-server
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 1LowAffects 1 version
Monthly breakdown
- 4 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 2
- Low: 1
Vulnerabilities (4)
Known vulnerabilities affecting dynatrace-oss-dynatrace-mcp-server, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-p7w7-4929-vpj5 | High | `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation### Summary `@dynatrace-oss/dynatrace-mcp-server` v1.8.5 exposes an HTTP transport mode (`--http` flag) that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC `tools/call` request without an `Authorization` header and have it executed directly under the victim server's Dynatrace credentials. Confirmed high-impact tools reachable without authentication include `execute_dql` (reads arbitrary Grail data, including logs, security events, and user sessions) and `create_dynatrace_note |
| GitHub (opens in a new tab) | |
| GHSA-pqh8-p93p-2rx7 | Moderate | @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL### Summary A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers. ### Details Several tools interpolate caller-supplied parameters directly into DQL query strings without quoting or escaping. The affected parameters are documented in their Zod schemas as identifiers or constrained shorthand (such as `"24h"` timeframe values or Kubernetes UIDs) - not as DQL expressions. The interpolation lets a caller break out of string literals, append |
| GitHub (opens in a new tab) | |
| GHSA-xrmj-5g4g-8987 | Moderate | @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification### Summary A template injection vulnerability in the `create_workflow_for_notification` tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends. ### Details The `create_workflow_for_notification` tool interpolates three caller-supplied parameters (`teamName`, `problemType`, `channel`) directly into a Dynatrace Workflow definition. Dynatrace Workflows use Jinja2 templating: per the [official documentation](https://do |
| GitHub (opens in a new tab) | |
| GHSA-pc2w-4mq8-32qw | Low | @dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent. ### Details `dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator's explicit con |
| GitHub (opens in a new tab) |
- GHSA-p7w7-4929-vpj5High`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
< 2.0.0
### Summary `@dynatrace-oss/dynatrace-mcp-server` v1.8.5 exposes an HTTP transport mode (`--http` flag) that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC `tools/call` request without an `Authorization` header and have it executed directly under the victim server's Dynatrace credentials. Confirmed high-impact tools reachable without authentication include `execute_dql` (reads arbitrary Grail data, including logs, security events, and user sessions) and `create_dynatrace_note
CVE: CVE-2026-123811
- GHSA-pqh8-p93p-2rx7Moderate@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
< 2.1.1
### Summary A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers. ### Details Several tools interpolate caller-supplied parameters directly into DQL query strings without quoting or escaping. The affected parameters are documented in their Zod schemas as identifiers or constrained shorthand (such as `"24h"` timeframe values or Kubernetes UIDs) - not as DQL expressions. The interpolation lets a caller break out of string literals, append
CVE: CVE-2026-123810
- GHSA-xrmj-5g4g-8987Moderate@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
< 2.0.0
### Summary A template injection vulnerability in the `create_workflow_for_notification` tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends. ### Details The `create_workflow_for_notification` tool interpolates three caller-supplied parameters (`teamName`, `problemType`, `channel`) directly into a Dynatrace Workflow definition. Dynatrace Workflows use Jinja2 templating: per the [official documentation](https://do
CVE: CVE-2026-123809
- GHSA-pc2w-4mq8-32qwLow@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
< 1.8.7
### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent. ### Details `dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator's explicit con
CVE: CVE-2026-123812