Jinja2 Expression Injection in Dynatrace MCP Server

CVE-2026-123809

What is CVE-2026-123809?

The Dynatrace MCP Server, prior to version 2.0.0, has a vulnerability in its create_workflow_for_notification functionality. This issue allows caller-controlled inputs such as teamName, problemType, and channel to be inserted into a Dynatrace workflow without properly neutralizing Jinja2 expressions. This lack of sanitization opens a path for an attacker to exploit the workflow engine to evaluate malicious template expressions like event(). When integrated with a Slack connector, it might reveal confidential event or tenant metadata to a chosen Slack channel, undermining the privacy and security of user data. By default, workflows are visible to other tenants unless explicitly marked as private. The vulnerability can be exploited through a prompt-injection or if an operator inadvertently approves a malicious prompt display. Users are encouraged to upgrade to version 2.0.0 or later to mitigate this risk.

References