Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
@dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode (--http flag) that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an Authorization header and have it executed directly under the victim server's Dynatrace credentials. Confirmed high-impact tools reachable without authentication include executedql (reads arbitrary Grail data, including logs, security events, and user sessions) and createdynatracenotebook (writes notebooks to the tenant). Details When the server is started with the --http flag, an HTTP server is created at src/index.ts:1621. For every inbound request the handler creates a new StreamableHTTPServerTransport instance: No bearer-token check, session token, Host allowlist, or Origin allowlist is configured on either the transport or in the surrounding request handler. The raw body is parsed and…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A template injection vulnerability in the createworkflowfornotification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends. Details The createworkflowfornotification tool interpolates three caller-supplied parameters (teamName, problemType, channel) directly into a Dynatrace Workflow definition. Dynatrace Workflows use Jinja2 templating: per the official documentation, {{ ... }} expressions in action inputs are evaluated at workflow runtime for every action except Run Javascript (which is carved out specifically to avoid code injection). A caller can therefore supply, for example, teamName = "{{ event() }}" and have the workflow engine evaluate that expression at runtime, serialising the full event object into the message body delivered to the Slack channel. The vulnerable code is in…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers. Details Several tools interpolate caller-supplied parameters directly into DQL query strings without quoting or escaping. The affected parameters are documented in their Zod schemas as identifiers or constrained shorthand (such as "24h" timeframe values or Kubernetes UIDs) - not as DQL expressions. The interpolation lets a caller break out of string literals, append arbitrary DQL pipeline stages, and use // line comments (documented in the Dynatrace DQL language reference) to discard the rest of the intended query. The marginal-privilege ceiling is low because the operator's token also exposes executedql with full DQL access. What the injection grants is the ability to bypass the affected tools' contract: the readOnlyHint: true annotation that MCP clients may treat as…
Recommended action: Upgrade to 2.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing human-approval gate on the createdynatracenotebook tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent. Details dynatrace-mcp-server registers six write tools: sendslackmessage, sendemail, sendevent, createworkflowfornotification, makeworkflowpublic, and createdynatracenotebook. Five of these call requestHumanApproval() before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added "to ensure user consent and prevent unintended actions." createdynatracenotebook does not call requestHumanApproval(). The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content…
Recommended action: Upgrade to 1.8.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.