The create_dynatrace_notebook tool in dynatrace-mcp-server lacks a call to requestHumanApproval(), unlike other write tools that require explicit operator consent before performing side effects. This missing approval gate allows an unauthenticated attacker to create tenant-visible notebooks containing arbitrary content, including embedded DQL queries. These queries execute with the permissions of any tenant user who opens the notebook, potentially crossing identity boundaries within the tenant. The vulnerability was confirmed with a proof-of-concept demonstrating notebook creation without eliciting operator approval. The affected versions are those prior to 1.8.7.

An unauthenticated attacker can create persistent documents visible to all tenant users without operator approval. The attacker controls the notebook content, including embedded DQL queries that execute under the permissions of any tenant user who opens the notebook. This could lead to unauthorized data access or information disclosure within the tenant environment. The vulnerability does not impact confidentiality directly but allows integrity violations by injecting arbitrary content and queries. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the MCP server to trusted users and ensure authentication is enforced to prevent unauthenticated calls. Monitor for unusual notebook creation activity. The vendor advisory or repository should be consulted for updates on official fixes or temporary mitigations.