dynatrace-oss vulnerabilities and threats

CVE-2026-123812 is a missing authorization vulnerability in dynatrace-mcp prior to version 1.8.7. The create_dynatrace_notebook registration performs a persistent document-write action without requiring human approval, unlike other write tools in the project. This allows an attacker to create tenant-visible notebooks with malicious Markdown or DQL content, which tenant users may execute when opening the notebook. The issue is fixed in version 1.8.7.

CVE-2026-123811 is a vulnerability in dynatrace-oss dynatrace-mcp versions prior to 2.0.0 where the server started with the --http option accepts JSON-RPC requests without authentication or session validation. This allows network-reachable attackers to invoke critical functions such as reading logs, security events, and user sessions, or creating tenant-visible notebooks. The issue is fixed in version 2.0.0.

CVE-2026-123810 is a SQL Injection vulnerability in dynatrace-oss dynatrace-mcp versions prior to 2.1.1. Several read capabilities improperly interpolate user-controlled input into DQL queries without sufficient validation or escaping. This allows crafted inputs to manipulate query structure, bypassing certain query restrictions. The vulnerability does not escalate data access beyond the token's existing execute_dql permissions. The issue is fixed in version 2.1.1.

A vulnerability in Dynatrace MCP Server versions prior to 2.0.0 allows improper neutralization of Jinja2 template expressions in certain workflow parameters. This can lead to unintended evaluation of attacker-controlled template code within persistent workflows, potentially disclosing event or tenant metadata via Slack actions if a valid Slack connector is configured. The issue is fixed in version 2.0.0.