Unauthorized Access Vulnerability in Dynatrace MCP Server
CVE-2026-123811

7.5HIGH

Key Information:

Vendor: Dynatrace-oss
Status: Dynatrace-mcp
Vendor: CVE Published:; 9 November 2026

🔔 Create Dynatrace-oss Vulnerability Alert

What is CVE-2026-123811?

The Dynatrace MCP Server, utilized for observability, possesses a vulnerability that allows unauthenticated JSON-RPC requests when started with the --http option. This flaw permits a network-reachable attacker to invoke specific functions, such as 'execute_dql', enabling them to access sensitive information like logs and user sessions. Furthermore, attackers can create tenant-visible notebooks through 'create_dynatrace_notebook'. An important note is that other paths, such as 'send_event', remain secure due to existing approval measures. This issue was effectively resolved in version 2.0.0.