CVE-2026-123812

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

Summary

A missing human-approval gate on the create_dynatrace_notebook tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.

Details

dynatrace-mcp-server registers six write tools: send_slack_message, send_email, send_event, create_workflow_for_notification, make_workflow_public, and create_dynatrace_notebook. Five of these call requestHumanApproval() before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added "to ensure user consent and prevent unintended actions."

create_dynatrace_notebook does not call requestHumanApproval(). The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.

The vulnerable code is in src/index.ts, lines 1563-1601:

tool(
  'create_dynatrace_notebook',
  'Create Dynatrace Notebook',
  'Create a new notebook in the Dynatrace platform ...',
  {
    name: z.string().describe(/* ... */),
    description: z.string().optional().describe(/* ... */),
    content: z.array(z.object({
      type: z.enum(['dql', 'markdown']),
      text: z.string(),
    })).describe(/* ... */),
  },
  {
    readOnlyHint: false,
  },
  async ({ name, content, description }) => {
    const dtClient = await createAuthenticatedHttpClient(allRequiredScopes);
    const data = await createDynatraceNotebook(dtClient, name, content, description);
    // No requestHumanApproval() call.
    // No destructiveHint annotation.
    // Scopes requested are allRequiredScopes (the broadest possible set)
    // even though only document:documents:write is needed.

    return data
      ? `Document created successfully: ${dtEnvironment}/ui/apps/dynatrace.notebooks/notebook/${data.id}`
      : 'document creation failed';
  },
);

By comparison, every other write tool calls requestHumanApproval() as its first action:

• send_email (line 1274): const approved = await requestHumanApproval(...);
• send_slack_message (line 652): const approved = await requestHumanApproval(...);
• send_event (line 1367): const approved = await requestHumanApproval(...);
• create_workflow_for_notification (line 1069): const approved = await requestHumanApproval(...);
• make_workflow_public (line 1118): const approved = await requestHumanApproval(...);

PoC

Tested end-to-end against a real Dynatrace tenant. The MCP server was started in HTTP mode with the operator's Platform Token:

export DT_ENVIRONMENT=https://<tenant>.apps.dynatrace.com
export DT_PLATFORM_TOKEN=dt0s16....
npx -y @dynatrace-oss/[email protected] --http --port 3000

A single unauthenticated POST from a process with no Dynatrace credentials of its own:

curl -sS http://127.0.0.1:3000/ \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{
    "jsonrpc": "2.0", "id": 1, "method": "tools/call",
    "params": {
      "name": "create_dynatrace_notebook",
      "arguments": {
        "name": "Unapproved notebook",
        "description": "Created without operator approval.",
        "content": [
          {"type": "markdown", "text": "# This notebook was created without approval"},
          {"type": "dql",      "text": "fetch logs | limit 10"}
        ]
      }
    }
  }'

The response:

event: message
data: {"result":{"content":[{"type":"text","text":"Document created successfully:
       https://<tenant>.apps.dynatrace.com/ui/apps/dynatrace.notebooks/notebook/<uuid>"}]},
      …

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

Summary

A missing human-approval gate on the create_dynatrace_notebook tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.

Details

dynatrace-mcp-server registers six write tools: send_slack_message, send_email, send_event, create_workflow_for_notification, make_workflow_public, and create_dynatrace_notebook. Five of these call requestHumanApproval() before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added "to ensure user consent and prevent unintended actions."

create_dynatrace_notebook does not call requestHumanApproval(). The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.

The vulnerable code is in src/index.ts, lines 1563-1601:

tool(
  'create_dynatrace_notebook',
  'Create Dynatrace Notebook',
  'Create a new notebook in the Dynatrace platform ...',
  {
    name: z.string().describe(/* ... */),
    description: z.string().optional().describe(/* ... */),
    content: z.array(z.object({
      type: z.enum(['dql', 'markdown']),
      text: z.string(),
    })).describe(/* ... */),
  },
  {
    readOnlyHint: false,
  },
  async ({ name, content, description }) => {
    const dtClient = await createAuthenticatedHttpClient(allRequiredScopes);
    const data = await createDynatraceNotebook(dtClient, name, content, description);
    // No requestHumanApproval() call.
    // No destructiveHint annotation.
    // Scopes requested are allRequiredScopes (the broadest possible set)
    // even though only document:documents:write is needed.

    return data
      ? `Document created successfully: ${dtEnvironment}/ui/apps/dynatrace.notebooks/notebook/${data.id}`
      : 'document creation failed';
  },
);

By comparison, every other write tool calls requestHumanApproval() as its first action:

• send_email (line 1274): const approved = await requestHumanApproval(...);
• send_slack_message (line 652): const approved = await requestHumanApproval(...);
• send_event (line 1367): const approved = await requestHumanApproval(...);
• create_workflow_for_notification (line 1069): const approved = await requestHumanApproval(...);
• make_workflow_public (line 1118): const approved = await requestHumanApproval(...);

PoC

Tested end-to-end against a real Dynatrace tenant. The MCP server was started in HTTP mode with the operator's Platform Token:

export DT_ENVIRONMENT=https://<tenant>.apps.dynatrace.com
export DT_PLATFORM_TOKEN=dt0s16....
npx -y @dynatrace-oss/[email protected] --http --port 3000

A single unauthenticated POST from a process with no Dynatrace credentials of its own:

curl -sS http://127.0.0.1:3000/ \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{
    "jsonrpc": "2.0", "id": 1, "method": "tools/call",
    "params": {
      "name": "create_dynatrace_notebook",
      "arguments": {
        "name": "Unapproved notebook",
        "description": "Created without operator approval.",
        "content": [
          {"type": "markdown", "text": "# This notebook was created without approval"},
          {"type": "dql",      "text": "fetch logs | limit 10"}
        ]
      }
    }
  }'

The response:

event: message
data: {"result":{"content":[{"type":"text","text":"Document created successfully:
       https://<tenant>.apps.dynatrace.com/ui/apps/dynatrace.notebooks/notebook/<uuid>"}]},
      …