Dynatrace MCP Server allows callers to create tenant‑visible notebooks without requiring operator consent, as the create_dynatrace_notebook registration bypasses the human‑approval gate. Attackers can embed malicious Markdown or Dynatrace Query Language (DQL) content in these notebooks. When a tenant user opens the notebook, the embedded DQL is executed, enabling unauthorized data queries or other DQL‑based actions. The vulnerability is a missing authorization check (CWE‑862) and can lead to privilege escalation within a tenant’s context, potentially exposing sensitive information or enabling further exploitation.

The vulnerability affects Dynatrace MCP Server prior to version 1.8.7. Systems that run any older release of the dynatrace‑oss dcp MCP server are impacted.

The CVSS score of 3.7 indicates a moderate severity and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it through the MCP API or through a user interface that allows notebook creation, and the lack of a destructiveHint annotation means clients are unaware of the side effects. Given that the issue permits execution of arbitrary DQL inside a tenant’s environment, the risk is significant for organizations that rely on strict tenant isolation.