Improper Input Validation in Dynatrace MCP Server

CVE-2026-123810

What is CVE-2026-123810?

The Dynatrace MCP Server, prior to version 2.1.1, contains a vulnerability where multiple read capabilities improperly handle caller-controlled values in DQL. Specifically, components like 'find-monitored-entity-by-name', 'list-problems', and 'get-events-for-cluster' fall short on validating or escaping user input. This can lead to crafted inputs that manipulate string literals, allowing attackers to bypass set limits on data access during read operations. While the current permissions scheme restricts unauthorized data access, this flaw undermines the intended execution constraints set for read-only tools. It is imperative to upgrade to version 2.1.1 to mitigate these risks.

References