The vulnerability resides in the Dynatrace MCP Server, a component that facilitates remote procedure calls for Dynatrace Observability. When launched with the `--http` flag, the server accepts JSON‑RPC requests on its HTTP interface without performing authentication, session validation, or Host and Origin checks. An attacker who can reach the HTTP endpoint can therefore invoke privileged tool calls such as `execute_dql` to retrieve logs, security events, and user session data, or `create_dynatrace_notebook` to create persistent tenant‑visible notebooks. Request bodies that would ordinarily require human approval, such as `send_event`, are protected by a gate, but that does not mitigate the exposed calls. The flaw enables unauthorized reading of sensitive data and creation of artifacts within the tenant. This issue is classified under CWE‑306, Missing Authentication, and is fixed in version 2.0.0.

The flaw affects deployments of Dynatrace MCP Server version 1.x running with the `--http` option. Specifically, any installation of the Dynatrace OSS MCP Server prior to the 2.0.0 release that exposes an HTTP endpoint is vulnerable. Older versions may be inadvertently used by some teams, especially those that have not upgraded or disabled the HTTP interface.

The CVSS score of 7.5 indicates a high severity. No EPSS score is provided, but the lack of authentication means that any network‑reachable host can exploit the flaw with no special skills. Because the server dispatches calls under the tenant’s Dynatrace credentials, the attacker has full tenant‑level read and write ability. The vulnerability is not listed in CISA’s KEV catalog, but it remains a significant risk for any exposed service. The attack vector is a network‑based unauthenticated remote attack, inferred from the description that any host able to reach the HTTP endpoint can send crafted JSON‑RPC requests. The problem is fixed in v2.0.0.