Executive brief
The Dynatrace MCP Server, a tool that integrates Dynatrace monitoring and data analysis capabilities, can be run in HTTP mode without any authentication checks. An attacker with network access can invoke sensitive operations under the server's own Dynatrace credentials, such as reading logs and security events or creating notebooks in the tenant, without providing any credentials.
Technical details
The vulnerability is an authentication bypass in the HTTP transport mode (--http flag) of @dynatrace-oss/dynatrace-mcp-server. When HTTP mode is enabled, the server creates a StreamableHTTPServerTransport that does not validate bearer tokens, session IDs, host, or origin before dispatching JSON-RPC tool calls. An unauthenticated network attacker can send a raw JSON-RPC request (e.g., tools/call) without an Authorization header and have it executed under the server's stored Dynatrace credentials. Two high-impact tools are confirmed reachable: execute_dql (allows arbitrary DQL queries reading logs, security events, and user sessions) and create_dynatrace_notebook (allows writing notebooks to the tenant). The flaw affects versions ≤1.8.7; version 2.0.0 and later include a patch that requires an HTTP auth token.
Affected products
- Dynatrace OSS dynatrace-mcp-server <= 1.8.7
Timeline
- 2026-07-31: disclosed
- 2026-06-09: patched: Patch released in version 2.0.0