AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-123811highBroken access control2026-11-09

CVE-2026-123811: Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests

Dynatrace MCP Server is an MCP server for Dynatrace Observability.

01.

What it is

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrace credentials. A network-reachable caller can invoke execute_dql to read logs, security events, user sessions, and other Grail data, or invoke create_dynatrace_notebook to create tenant-visible notebooks.

02.

How to check

  1. Compare your installed version with the range above (command below).
03.

How to fix

    04.

    Sources

    More advisories for this tool
    The weekly email

    One email a week. Only what changed.

    Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

    Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.