Executive brief
The Dynatrace MCP Server is a tool that orchestrates actions on the Dynatrace monitoring platform, including creating documents, sending notifications, and modifying workflows. The create_dynatrace_notebook function lacks the built-in human-approval gate present on all other write operations, allowing unauthenticated callers to silently create persistent notebooks containing arbitrary content—including executable DQL queries that run under any user's permissions who later opens the notebook.
Technical details
The vulnerability is a missing authorization/approval check (CWE-862) in the create_dynatrace_notebook tool handler. The root cause is that while five other write tools (send_slack_message, send_email, send_event, create_workflow_for_notification, make_workflow_public) all call requestHumanApproval() at the start of execution to elicit operator consent via the MCP protocol, the create_dynatrace_notebook function was introduced in a separate release and left ungated. The attack requires network reachability to the HTTP-mode MCP server; when HTTP authentication is disabled, no credentials are required. An attacker can craft a JSON-RPC POST request to create a notebook with embedded DQL queries that execute under the identity of subsequent users who view the notebook, creating a stored cross-identity execution pattern. Patch: upgrade to version 1.8.7 or later.
Affected products
- Dynatrace MCP Server up to and including 1.8.6
Timeline
- 2026-07-29: disclosed: Advisory published on GitHub Security Advisory