EUVD-2026-120442Published
Dynatrace MCP Server: Workflow template injection via create_workflow_for_notification
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-123809 · CVE overview and exploitation status
cve-program · CVE-2026-123809
- https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987
- https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a
- https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0
euvd · EUVD-2026-120442
- https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987
- https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a
- https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0
nvd · CVE-2026-123809
- https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a
- https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0
- https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987
osv · GHSA-xrmj-5g4g-8987
- https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987
- https://github.com/dynatrace-oss/dynatrace-mcp/pull/547
- https://github.com/dynatrace-oss/dynatrace-mcp/commit/64dfcb1095823d0fb43013635446288a6ff60e29
- https://github.com/dynatrace-oss/dynatrace-mcp
- https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0
Related changes
Linked by CVE identifier- Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutraliz… · Advisory content revised · 13 Nov 2026
- Dynatrace MCP Server: Workflow template injection via create_workflow_for_notification · Newly collected advisory · 9 Nov 2026
- @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification · Advisory content revised · 9 Nov 2026