MCPA-2026-0023
mediumrce-vectorsCVSS 4.2
Dynatrace MCP Server workflow template injection via create_workflow_for_notification (GHSA-xrmj-5g4g-8987)
@dynatrace-oss/dynatrace-mcp-server before 2.0.0 interpolates three caller-supplied parameters (teamName, problemType, channel) of the create_workflow_for_notification tool directly into a Dynatrace Workflow definition. Dynatrace Workflows evaluate Jinja2 {{ ... }} expressions in action inputs at runtime, so injected expressions (e.g. {{ event() }}) can exfiltrate event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends. Fixed in 2.0.0 (PR #547).
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @dynatrace-oss/dynatrace-mcp-server | >= 0, < 2.0.0 |
Identifiers
GHSA-xrmj-5g4g-8987CWE-1336
References
- advisory https://github.com/advisories/GHSA-xrmj-5g4g-8987
- advisory https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987
- fix https://github.com/dynatrace-oss/dynatrace-mcp/pull/547
- fix https://github.com/dynatrace-oss/dynatrace-mcp/commit/64dfcb1095823d0fb43013635446288a6ff60e29
Timeline
- Published: 2026-07-31