# Dynatrace MCP Server DQL injection via unquoted parameters

Source: https://junglewise.ai/threats/dynatrace-mcp-server-dql-injection-via-unquoted-parameters-7a308c6e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-07-31

The Dynatrace Model Context Protocol (MCP) Server is a bridge that allows AI assistants and other applications to query monitoring data. A vulnerability allows attackers to inject malicious DQL (Dynatrace Query Language) commands through tool parameters that should accept only identifiers or time values, bypassing safety restrictions like field limits and time windows. This could enable unauthorized data access or allow AI systems to be tricked into exposing monitoring secrets through prompt injection.

Technologies: [Dynatrace-Mcp-Server](https://junglewise.ai/threats/technologies/dynatrace-mcp-server), [@dynatrace-oss/dynatrace-mcp-server (npm)](https://junglewise.ai/threats/technologies/dynatrace-oss-dynatrace-mcp-server). Vendors: [Dynatrace](https://junglewise.ai/threats/vendors/dynatrace), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 31 July 2026.

**Which products and versions are affected?** Dynatrace-Mcp-Server up to and including 1.8.5; @dynatrace-oss/dynatrace-mcp-server (npm) SEMVER:introduced=0,fixed=2.1.1.

**Is there a fix for This vulnerability?** Yes. @dynatrace-oss/dynatrace-mcp-server (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Dynatrace-Mcp-Server or @dynatrace-oss/dynatrace-mcp-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @dynatrace-oss/dynatrace-mcp-server (npm): upgrade to 2.1.1 or later

  ```sh
  npm install @dynatrace-oss/dynatrace-mcp-server@2.1.1
  ```


## Technical details

The vulnerability is a DQL (Dynatrace Query Language) injection in several read-only tools. Multiple capabilities (find-monitored-entity-by-name, list-problems, list-vulnerabilities, list-exceptions, get-events-for-cluster) directly interpolate unsanitized user-supplied parameters into DQL query strings without quoting or escaping. Parameters documented as identifiers or constrained values (e.g., "24h" timeframe, Kubernetes UIDs) are concatenated directly into DQL queries, allowing attackers to break out of string literals using quote characters and inject arbitrary DQL pipeline stages. Exploitation requires user interaction (MCP client interaction or LLM prompt injection) and no authentication, but is limited to information disclosure through bypassing the tools' field-scope and time-window restrictions. The fix involves proper parameter validation and quoting; patched versions v2.1.1 and newer are available.

## Affected products

- Dynatrace dynatrace-mcp-server up to and including 1.8.5

## Timeline

- 2026-07-31: disclosed: Advisory published
- 2026-07-31: patched: Fix released in v2.1.1 and newer

## References

- [https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pqh8-p93p-2rx7](https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-pqh8-p93p-2rx7)
- [https://github.com/dynatrace-oss/dynatrace-mcp/pull/562](https://github.com/dynatrace-oss/dynatrace-mcp/pull/562)

## Related threats

- [Dynatrace MCP Server authentication bypass in HTTP mode](https://junglewise.ai/threats/cve-2026-123811-dynatrace-mcp-server-is-an-mcp-server-for-dynatrace)
- [Dynatrace MCP Server DQL injection in read capabilities](https://junglewise.ai/threats/cve-2026-123810-dynatrace-mcp-server-is-an-mcp-server-for-dynatrace)
- [Dynatrace MCP Server template injection in workflow creation](https://junglewise.ai/threats/cve-2026-123809-dynatrace-mcp-server-is-an-mcp-server-for-dynatrace)
- [Dynatrace MCP Server HTTP authentication bypass](https://junglewise.ai/threats/dynatrace-mcp-server-http-authentication-bypass-ce289649)
- [Dynatrace MCP Server template injection in create_workflow_for_notification](https://junglewise.ai/threats/dynatrace-mcp-server-template-injection-in-create-workflow-for-f3cb1211)