https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 18:05:25 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123812 <p>Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project&#39;s other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.</p> <p>Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project&#39;s other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123812 https://db.gcve.eu/vuln/ghsa-pc2w-4mq8-32qw <p><strong>Affected:</strong> npm: @dynatrace-oss/dynatrace-mcp-server</p> <p>### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.</p> <p>### Details `dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator&#39;s explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added &#34;to ensure user consent and prevent unintended actions.&#34;</p> <p>`create_dynatrace_notebook` does not call `requestHumanApproval()`. The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.</p> <p>The vulnerable code is in `src/index.ts`, lines 1563-1601:</p> <p>```typescript tool( &#39;create_dynatrace_notebook&#39;, &#39;Create Dynatrace Notebook&#39;, &#39;Create a new notebook in the Dynatrace platform ...&#39;, { name: z.string().describe(/* ... */), description: z.string().optional().describe(/* ... */),…</p> <p><strong>Affected:</strong> npm: @dynatrace-oss/dynatrace-mcp-server</p> <p>### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.</p> <p>### Details `dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator&#39;s explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added &#34;to ensure user consent and prevent unintended actions.&#34;</p> <p>`create_dynatrace_notebook` does not call `requestHumanApproval()`. The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.</p> <p>The vulnerable code is in `src/index.ts`, lines 1563-1601:</p> <p>```typescript tool( &#39;create_dynatrace_notebook&#39;, &#39;Create Dynatrace Notebook&#39;, &#39;Create a new notebook in the Dynatrace platform ...&#39;, { name: z.string().describe(/* ... */), description: z.string().optional().describe(/* ... */),…</p> https://db.gcve.eu/vuln/ghsa-pc2w-4mq8-32qw