@dynatrace-oss/dynatrace-mcp-server
npm4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @dynatrace-oss/dynatrace-mcp-serverpage 1 of 1
- CVE-2026-123809MEDIUMCVSS 4.2EG 4.2fixed in 2.0.02026-11-09
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutrali…
- CVE-2026-123810MEDIUMCVSS 4.3EG 4.3fixed in 2.1.12026-11-09
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entit…
- CVE-2026-123811HIGHCVSS 7.5EG 7.5fixed in 2.0.02026-11-09
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections befo…
- CVE-2026-123812LOWCVSS 3.7EG 3.7fixed in 1.8.72026-11-09
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the pr…
Check whether @dynatrace-oss/dynatrace-mcp-server is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @dynatrace-oss/dynatrace-mcp-server CVEs against the assets you own.
Book a Demo →