Persistent Document-Write Vulnerability in Dynatrace MCP Server
CVE-2026-123812

3.7LOW

Key Information:

Vendor

Dynatrace-oss

Status
Dynatrace-mcp
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123812?

The Dynatrace MCP Server prior to version 1.8.7 contains a persistent document-write vulnerability. The 'create_dynatrace_notebook' registration method performs write actions without the necessary operator consent, which could allow attackers to insert malicious Markdown or DQL content into notebooks visible to tenants. Users may inadvertently execute harmful DQL upon accessing these notebooks. Additionally, the absence of a destructiveHint annotation means that users are not informed of potential side effects. This vulnerability compromises tenant data integrity and user trust.

Affected Version(s)

dynatrace-mcp < 1.8.7

References

https://github.com/dynatrace-oss/dynatrace-mcp/security/a...
x_refsource_CONFIRM
https://github.com/dynatrace-oss/dynatrace-mcp/commit/285...
x_refsource_MISC
https://github.com/dynatrace-oss/dynatrace-mcp/releases/t...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.