CVE-2026-123811
Dynatrace MCP Server
- Severity
- High
- Published
- November 9, 2026
- Last modified
- November 9, 2026
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrace credentials. A network-reachable caller can invoke execute_dql to read logs, security events, user sessions, and other Grail data, or invoke create_dynatrace_notebook to create tenant-visible notebooks. The send_event path is not affected because its requestHumanApproval gate blocks this attack path, and reset_grail_budget only demonstrates dispatch without accessing Dynatrace data. This issue is fixed in version 2.0.0.
CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
Weakness
- CWE-306 Missing authentication
References
Listed in
More Dynatrace MCP Server CVEs
The create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain…
Several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping.
The create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions.