Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dynatrace-mcp",
          "vendor": "dynatrace-oss",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project\u0027s other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:02:43.516Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pc2w-4mq8-32qw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pc2w-4mq8-32qw"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/2851d3ce29d834c93b67f0db903c10e0b488e7ac",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/2851d3ce29d834c93b67f0db903c10e0b488e7ac"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v1.8.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v1.8.7"
        }
      ],
      "source": {
        "advisory": "GHSA-pc2w-4mq8-32qw",
        "discovery": "UNKNOWN"
      },
      "title": "Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123812",
    "datePublished": "2026-11-09T21:02:43.516Z",
    "dateReserved": "2026-11-06T15:27:56.226Z",
    "dateUpdated": "2026-11-09T21:02:43.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dynatrace-mcp",
          "vendor": "dynatrace-oss",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server\u0027s configured Dynatrace credentials. A network-reachable caller can invoke execute_dql to read logs, security events, user sessions, and other Grail data, or invoke create_dynatrace_notebook to create tenant-visible notebooks. The send_event path is not affected because its requestHumanApproval gate blocks this attack path, and reset_grail_budget only demonstrates dispatch without accessing Dynatrace data. This issue is fixed in version 2.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:01:42.490Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-p7w7-4929-vpj5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-p7w7-4929-vpj5"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f12972481e9165e8bd24d63b0a9e71976f85a43",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f12972481e9165e8bd24d63b0a9e71976f85a43"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/ac5251edfcf9511c6c662414da743383e7d1451c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/ac5251edfcf9511c6c662414da743383e7d1451c"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/ead820322238633f5b289778c57faf5d3a8d73f9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/ead820322238633f5b289778c57faf5d3a8d73f9"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p7w7-4929-vpj5",
        "discovery": "UNKNOWN"
      },
      "title": "Dynatrace MCP Server: Unauthenticated HTTP MCP Tool Invocation in `@dynatrace-oss/dynatrace-mcp-server`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123811",
    "datePublished": "2026-11-09T21:01:42.490Z",
    "dateReserved": "2026-11-06T15:27:56.226Z",
    "dateUpdated": "2026-11-09T21:01:42.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dynatrace-mcp",
          "vendor": "dynatrace-oss",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string searches, src/capabilities/list-problems.ts, src/capabilities/list-vulnerabilities.ts, and src/capabilities/list-exceptions.ts embed timeframe values, and src/capabilities/get-events-for-cluster.ts embeds timeframe, clusterId, and kubernetesEntityId. Crafted values can close string literals, append pipeline stages, or comment out the remaining intended query, allowing callers to bypass field selection, time-window, and result-display limits in tools marked readOnlyHint. The issue does not grant data access beyond the configured token\u0027s existing execute_dql capability, but it breaks the narrower auto-approved tool contract. This issue is fixed in version 2.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T20:59:50.956Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pqh8-p93p-2rx7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pqh8-p93p-2rx7"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/15d3546c0618ffbaeaeca477337e08e92f2151bc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/15d3546c0618ffbaeaeca477337e08e92f2151bc"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-pqh8-p93p-2rx7",
        "discovery": "UNKNOWN"
      },
      "title": "Dynatrace MCP Server: DQL injection via parameters not documented as DQL"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123810",
    "datePublished": "2026-11-09T20:59:50.956Z",
    "dateReserved": "2026-11-06T15:27:56.226Z",
    "dateUpdated": "2026-11-09T20:59:50.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dynatrace-mcp",
          "vendor": "dynatrace-oss",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template expressions such as event() in those values, and the workflow engine evaluates them when the persistent workflow runs. When the workflow has a valid Slack connector, the resulting Slack action can disclose event or tenant metadata to an attacker-selected channel; the shipped placeholder connection does not deliver messages by itself. The workflow remains in the tenant after the MCP session and credentials are gone. The isPrivate option defaults to false, making the created workflow tenant-visible unless the caller changes it. Exploitation requires either an MCP prompt-injection path or an operator approving a prompt that displays the template fragment literally. This issue is fixed in version 2.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T20:53:14.455Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a"
        },
        {
          "name": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xrmj-5g4g-8987",
        "discovery": "UNKNOWN"
      },
      "title": "Dynatrace MCP Server: Workflow template injection via create_workflow_for_notification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123809",
    "datePublished": "2026-11-09T20:53:14.455Z",
    "dateReserved": "2026-11-06T15:27:56.226Z",
    "dateUpdated": "2026-11-09T20:53:14.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}