The create_workflow_for_notification tool in Dynatrace MCP Server inserts the caller‑controlled values teamName, problemType and channel directly into a Jinja2 workflow template without neutralization. An attacker can embed Jinja2 expressions such as event() in these values and, when the persistent workflow executes, the workflow engine evaluates them. If the tenant contains a Slack connector, the resulting Slack action may publish event or tenant metadata to an arbitrary channel, thereby leaking sensitive information. The workflow remains in the tenant after the MCP session ends, and the isPrivate flag defaults to false, so the injected workflow is visible to all tenants unless changed by the operator.

Dynatrace MCP Server (dynatrace‑oss:dynatrace‑mcp) before version 2.0.0 is affected. The issue was fixed in release 2.0.0, which removes the vulnerability of injecting unsanitized Jinja2 expressions into workflows.

The CVSS v3 score of 4.2 indicates medium risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to use the create_workflow_for_notification interface – either by manipulating a prompt injection path or by having an operator approve a prompt that contains the injected template fragment. The attack vector is therefore limited to trusted or compromised users with access to the MCP interface, making the risk less likely to be realized from an external actor but still significant for an internal threat or misconfigured system.