Dynatrace MCP Server versions before 2.1.1 embed caller‑controlled values directly into DQL expressions without adequate escaping or validation. The use of these parameters in capabilities such as find‑monitored‑entity‑by‑name, list‑problems, list‑vulnerabilities, list‑exceptions, and get‑events‑for‑cluster permits an attacker to close string literals, append pipeline stages, or comment out the remainder of a query. This form of SQL‑like injection can circumvent field‑selection limits, time‑window restrictions, and result‑display caps on read‑only tools. The vulnerability does not grant access beyond the token’s existing execute_dql privilege, but it breaks the narrower auto‑approved tool contract and exposes more data than intended. The weakness corresponds to CWE‑89 – Improper Neutralization of Special Elements in an Expression Language Query.

The affected product is the Dynatrace MCP Server as distributed by dynatrace‑oss under the dynatrace‑mcp package. All releases prior to v2.1.1 are vulnerable, including every build that has not applied the fix introduced in the 2.1.1 release. System administrators should verify the specific build installed and compare it to the fixed version.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector appears to be remote, via crafted API requests to the affected capability endpoints that accept user-supplied parameters. An attacker with network access to the MCP Server and knowledge of a token with execute_dql capability could construct a malicious payload that bypasses the intended query limits. The exploitation prerequisites are minimal, requiring only the ability to send HTTP requests to the service, and the attack is feasible with standard tools.