# Dynatrace MCP Server template injection in create_workflow_for_notification

Source: https://junglewise.ai/threats/dynatrace-mcp-server-template-injection-in-create-workflow-for-f3cb1211  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-07-31

The Dynatrace MCP Server is a tool that integrates with Dynatrace's monitoring and automation platform. An attacker can inject malicious template code into workflow creation parameters, causing the Dynatrace workflow engine to evaluate arbitrary expressions at runtime and exfiltrate sensitive event data through persistent workflows that remain active even after the MCP session ends.

Technologies: [@dynatrace-oss/dynatrace-mcp-server (npm)](https://junglewise.ai/threats/technologies/dynatrace-oss-dynatrace-mcp-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 31 July 2026.

**Which products and versions are affected?** @dynatrace-oss/dynatrace-mcp-server (npm) SEMVER:introduced=0,fixed=2.0.0.

**Is there a fix for This vulnerability?** Yes. @dynatrace-oss/dynatrace-mcp-server (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run @dynatrace-oss/dynatrace-mcp-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @dynatrace-oss/dynatrace-mcp-server (npm): upgrade to 2.0.0 or later

  ```sh
  npm install @dynatrace-oss/dynatrace-mcp-server@2.0.0
  ```


## Technical details

The vulnerability is a template injection flaw in the create_workflow_for_notification tool. The tool concatenates user-supplied parameters (teamName, problemType, channel) directly into a Jinja2 template without validation, and these expressions are evaluated at workflow runtime by the Dynatrace Automation API. An attacker with access to the MCP server can supply payloads like teamName="{{ event() }}" to execute arbitrary Jinja2 expressions. The channel parameter is particularly dangerous as it is nested inside an existing {{ "..." }} context, allowing expression escape. The created workflows persist in the tenant indefinitely and fire on every matching problem condition, enabling sustained data exfiltration. No authentication is required beyond access to the MCP server itself. Patches are available in version 2.0.0 and later.

## Affected products

- Dynatrace @dynatrace-oss/dynatrace-mcp-server up to and including 1.8.5

## Timeline

- 2026-06-09: disclosed: Advisory published on GitHub
- 2026-07-31: advisory: Published to OSV database
- 2026: patched: Fixed in version 2.0.0 and later

## References

- [https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987](https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987)
- [https://github.com/dynatrace-oss/dynatrace-mcp/pull/547](https://github.com/dynatrace-oss/dynatrace-mcp/pull/547)

## Related threats

- [Dynatrace MCP Server HTTP authentication bypass](https://junglewise.ai/threats/dynatrace-mcp-server-http-authentication-bypass-ce289649)
- [Dynatrace MCP Server DQL injection via unquoted parameters](https://junglewise.ai/threats/dynatrace-mcp-server-dql-injection-via-unquoted-parameters-7a308c6e)
- [Dynatrace MCP Server create_dynatrace_notebook missing approval gate](https://junglewise.ai/threats/dynatrace-mcp-server-create-dynatrace-notebook-missing-approval-gate-5c6aa365)