CVE-2026-123812: Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate

Q: Which deployments are affected?

Dynatrace MCP Server versions prior to 1.8.7 are affected. Version 1.8.7 contains the fix.

Q: What does an attacker need to do to exploit this?

A caller must be able to invoke the create_dynatrace_notebook tool. The tool can then create a tenant-visible notebook without the human-approval step, using attacker-controlled Markdown or DQL content.

Q: What is the practical impact after a notebook is created?

Tenant users may encounter the attacker-created notebook, and embedded DQL may be executed when they open it. The immediate unauthorized action is creation of a persistent, tenant-visible document.

Q: How can I tell whether I may already be affected?

Review tenant-visible notebooks for unexpected creations or notebooks containing untrusted Markdown or DQL content. Also determine whether create_dynatrace_notebook was available through an MCP Server version earlier than 1.8.7.

Published Nov 9, 2026

Updated

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

Affected Software

1 affected component

Dynatrace Dynatrace MCP Server<1.8.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Dynatrace MCP Server to a version that resolves this vulnerability.
Fixed in 1.8.7

Event History

Nov 9, 2026

CVE Published

via MITRE·09:02 PM

Data Sourced

via MITRE·09:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Dynatrace MCP Server versions prior to 1.8.7 are affected. Version 1.8.7 contains the fix.

What does an attacker need to do to exploit this?

A caller must be able to invoke the create_dynatrace_notebook tool. The tool can then create a tenant-visible notebook without the human-approval step, using attacker-controlled Markdown or DQL content.

What is the practical impact after a notebook is created?

Tenant users may encounter the attacker-created notebook, and embedded DQL may be executed when they open it. The immediate unauthorized action is creation of a persistent, tenant-visible document.

How can I tell whether I may already be affected?

Review tenant-visible notebooks for unexpected creations or notebooks containing untrusted Markdown or DQL content. Also determine whether create_dynatrace_notebook was available through an MCP Server version earlier than 1.8.7.

CVE-2026-123812: Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to exploit this?

What is the practical impact after a notebook is created?

How can I tell whether I may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to exploit this?

What is the practical impact after a notebook is created?

How can I tell whether I may already be affected?