Executive brief
A security flaw in the Dynatrace Model Context Protocol (MCP) server allows unauthorized creation of Dynatrace notebooks. This server is used to connect AI models and other tools to Dynatrace environments. An attacker could use this to place malicious content or scripts into a company's Dynatrace dashboard without the required human approval, potentially leading to unauthorized data access when other employees open the affected notebooks.
Technical details
The vulnerability is classified as Missing Authorization (CWE-862) within the `@dynatrace-oss/dynatrace-mcp-server` package. While other write-capable tools in the server implement a `requestHumanApproval()` call to ensure operator consent via the MCP elicitation protocol, the `create_dynatrace_notebook` tool lacks this gate. An attacker—either via unauthenticated network requests to the HTTP transport or through prompt injection against a connected LLM—can silently create notebooks. These notebooks can contain malicious Dynatrace Query Language (DQL) queries that execute with the permissions of any user who subsequently views the document. The issue is resolved in version 1.8.7.
Affected products
- Dynatrace @dynatrace-oss/dynatrace-mcp-server < 1.8.7
Timeline
- 2026-06-08: disclosed
- 2026-07-29: patched: Version 1.8.7 released
- 2026-07-29: advisory
References
- https://api.github.com/users/yotampe-pluto
- https://github.com/yotampe-pluto
- https://api.github.com/users/yotampe-pluto/gists%7B/gist_id%7D
- https://api.github.com/users/yotampe-pluto/repos
- https://avatars.githubusercontent.com/u/252890338?v=4
- https://api.github.com/users/yotampe-pluto/events%7B/privacy%7D