VulnerabilityPublished 31 Jul 2026

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

Affects @dynatrace-oss/dynatrace-mcp-serverSource GCVE Database

CVSS 4.3 Medium : upgrade to 2.1.1 when convenient.

Data as of 1 Aug 2026, 21:17 UTC

CVSS 3.1 base score

4.3Medium

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 2.1.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Upgrade @dynatrace-oss/dynatrace-mcp-server to 2.1.1.

Affected software

Product	Affected	Fixed in
npm@dynatrace-oss/dynatrace-mcp-server	Affected <2.1.1	Fixed in 2.1.1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available for this vulnerability. Users should upgrade @dynatrace-oss/dynatrace-mcp-server to version 2.1.1 or later to address the injection issues. The patch corrects the unsafe interpolation of parameters into DQL queries by properly validating or escaping inputs. Until patched, avoid using affected tools with untrusted input or restrict access to trusted users only. Check the vendor advisory for detailed patch instructions and confirm upgrade status.

Description

### Summary A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers. ### Details Several tools interpolate caller-supplied parameters directly into DQL query strings without quoting or escaping. The affected parameters are documented in their Zod schemas as identifiers or constrained shorthand (such as `"24h"` timeframe values or Kubernetes UIDs) - not as DQL expressions. The interpolation lets a caller break out of string literals, append arbitrary DQL pipeline stages, and use `//` line comments (documented in the [Dynatrace DQL language reference](https://docs.dynatrace.com/docs/discover-dynatrace/platform/grail/dynatrace-query-language/dql-reference)) to discard the rest of the intended query. The marginal-privilege ceiling is low because the operator's token also exposes `execute_dql` with full DQL access. What the injection grants is the ability to bypass the affected tools' contract: the `readOnlyHint: true` annotation that MCP clients may treat as a signal to auto-approve, the per-tool field selection (e.g., `| fields id, name, type`), the display caps (`maxProblemsToDisplay`, `maxVulnerabilitiesToDisplay`, `maxEntitiesToDisplay`), and the time-window bounds. The vulnerable interpolations are: | File | Line | Parameter | Interpolation | |------|------|-----------|---------------| | `src/capabilities/find-monitored-entity-by-name.ts` | 23 | `entityNames[]` | `` `fetch ${entityType} \| search "*${entityNames.join('*" OR "*')}*" \| fieldsAdd entity.type \| expand tags` `` | | `src/capabilities/find-monitored-entity-by-name.ts` | 41 | `entityNames[]` | `` `smartscapeNodes "*" \| search "*${entityNames.join('*" OR "*')}*" \| fields id, name, type` `` | | `src/capabilities/list-problems.ts` | 27 | `timeframe` | `` `fetch dt.davis.problems, from: now()-${timeframe}, to: now()` `` | | `src/capabilities/list-vulnerabilities.ts` | 19 | `timeframe` | `` `fetch security.events, from: now()-${timeframe}, to: now()` `` | | `src/capabilities/list-exceptions.ts` | 11 | `timeframe` | `` `fetch user.events, from: now()-${timeframe}, to: now()` `` | | `src/capabilities/get-events-for-cluster.ts` | 20 | `timeframe` | `` `fetch events, from: now()-${timeframe}, to: now()` `` | | `src/capabilities/get-events-for-cluster.ts` | 27 | `clusterId`, `kubernetesEntityId` | `` `\| filter k8s.cluster.uid == "${clusterId}" or dt.entity.kubernetes_cluster == "${kubernetesEntityId}"` `` | All Zod schemas for these parameters use `z.string()` or `z.array(z.string())` with no pattern validation. ### PoC **`clusterId` - quote-and-comment break-out.** With `clusterId = 'x" or 1==1 //'` the constructed query becomes: ``` | filter k8s.cluster.uid == "x" or 1==1 //" or dt.entity.kubernetes_cluster == "" ``` The first `"` closes the string literal, `or 1==1` neutralises the filter to match every row, and `//` discards the rest of the line including the `kubernetesEntityId` guard. **`entityNames` - pipeline-stage injection.** With `entityNames = ['svc" | fields id, name, tags //']` the constructed smartscape query becomes: ``` smartscapeNodes "*" | search "*svc" | fields id, name, tags //*" | fields id, name, type ``` After the `//` line comment, the effective query is `smartscapeNodes "*" | search "*svc" | fields id, name, tags`. The original `| fields id, name, type` stage is suppressed and replaced with the attacker's field selection - the tool returns whatever field set the attacker requests (including ones not in the tool's documented output contract). **`timeframe` - prefix injection.** With `timeframe = '30d, to: now() | fieldsAdd internal_secret //'` the list-problems query becomes: ``` fetch dt.davis.problems, from: now()-30d, to: now() | fieldsAdd internal_secret //, to: now() | filter isNull(dt.davis.is_duplicate) OR not(dt.davis.is_duplicate) ... ``` A new pipeline stage is injected before the tool's intended `| filter`, and the rest of the query is commented out. The server's own `verify_dql` tool can be used to confirm any specific injection payload parses as valid DQL. ### Impact - A caller (typically via prompt injection of an LLM that has access to the affected tools) can bypass the tools' field-scope, time-window, and display caps. - The affected tools are annotated `readOnlyHint: true`, which some MCP clients treat as a signal to auto-approve. The injection turns a "safe" read tool into an arbitrary-DQL surface. - No new data access beyond what `execute_dql` already provides - the marginal impact is the auto-approval pathway and the broken tool contract, not privilege escalation.

Impact

An attacker can bypass the affected tools' documented field-scope, time-window, and display caps by injecting arbitrary DQL pipeline stages. This effectively turns read-only tools into arbitrary DQL execution surfaces, potentially exposing more data than intended by the tool's contract. However, no new data access privileges are gained beyond what the operator's execute_dql permission already allows. The main impact is the violation of the tools' read-only and limited-scope guarantees, which may lead to unintended data exposure or misuse in environments that auto-approve read-only queries.

Summary

The vulnerability arises from direct interpolation of user-supplied parameters into Dynatrace Query Language (DQL) strings without sanitization. Parameters such as entityNames, timeframe, clusterId, and kubernetesEntityId are documented as simple strings or identifiers but are used in query construction in a way that allows injection of additional DQL pipeline stages and line comments. This enables bypassing of field selection, time bounds, and display caps enforced by the tools. The marginal privilege impact is limited since the operator token already has full execute_dql rights; the main risk is that tools annotated as read-only can be coerced into executing arbitrary DQL queries, violating their intended constraints.

CWE-943Improper Neutralization of Special Elements in Data Query Logic (opens in a new tab)
Class weakness
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
Attack patterns
NoSQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 31 Jul 2026, 20:19 UTC

WeaknessesCWE-943

Technical details

References

Community reviews

Related threats