dynatrace-oss dynatrace-mcp up to 1.x Jinja2 Expression create_workflow_for_notification teamName/problemType/channel special elements in template engine

Summaryinfo

A vulnerability was found in dynatrace-oss dynatrace-mcp up to 1.x and classified as critical. Affected is the function create_workflow_for_notification of the component Jinja2 Expression Handler. Such manipulation of the argument teamName/problemType/channel leads to special elements in template engine. This vulnerability is listed as CVE-2026-123809. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in dynatrace-oss dynatrace-mcp up to 1.x. Affected by this issue is the function create_workflow_for_notification of the component Jinja2 Expression Handler. The manipulation of the argument teamName/problemType/channel with an unknown input leads to a special elements in template engine vulnerability. Using CWE to declare the problem leads to CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template expressions such as event() in those values, and the workflow engine evaluates them when the persistent workflow runs. When the workflow has a valid Slack connector, the resulting Slack action can disclose event or tenant metadata to an attacker-selected channel; the shipped placeholder connection does not deliver messages by itself. The workflow remains in the tenant after the MCP session and credentials are gone. The isPrivate option defaults to false, making the created workflow tenant-visible unless the caller changes it. Exploitation requires either an MCP prompt-injection path or an operator approving a prompt that displays the template fragment literally. This issue is fixed in version 2.0.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-123809 since 11/06/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1221.

Upgrading to version 2.0.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• dynatrace-oss

Name

• dynatrace-mcp

Version

• 1.x

Website

• Product: https://github.com/dynatrace-oss/dynatrace-mcp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion