{"answers":{"affected":"2 open source packages ship an affected version, including @dynatrace-oss/dynatrace-mcp-server.","exploited":"There is no known exploitation of GHSA-pc2w-4mq8-32qw in the wild and no public exploit code.","fix":"Upgrade @dynatrace-oss/dynatrace-mcp-server to 1.8.7 or later.","what":"GHSA-pc2w-4mq8-32qw is a missing authorization vulnerability in @dynatrace-oss/dynatrace-mcp-server, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-pc2w-4mq8-32qw and fix it if it is affected.\n\nWhat it is: GHSA-pc2w-4mq8-32qw is a missing authorization vulnerability in @dynatrace-oss/dynatrace-mcp-server, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-pc2w-4mq8-32qw in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @dynatrace-oss/dynatrace-mcp-server (npm): affected all versions; fixed in 1.8.7\n- @dynatrace-oss/dynatrace-mcp-server (npm): affected all versions; fixed in 1.8.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-pc2w-4mq8-32qw/ (Markdown: https://insights.sbomify.com/GHSA-pc2w-4mq8-32qw/index.md)","id":"GHSA-pc2w-4mq8-32qw","markdown":"https://insights.sbomify.com/GHSA-pc2w-4mq8-32qw/index.md","name":"GHSA-pc2w-4mq8-32qw","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_modify","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Dynatrace MCP server","requires_auth":"low_privilege","summary":"Attackers can create persistent Dynatrace notebooks with arbitrary content and embedded queries without operator approval, potentially leading to privilege escalation when other users open them.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nA missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.\n\n### Details\n`dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added \"to ensure user consent and prevent unintended actions.\"\n\n`create_dynatrace_notebook` does not call `requestHumanApproval()`. The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.\n\nThe vulnerable code is in `src/index.ts`, lines 1563-1601:\n\n```typescript\ntool(\n  'create_dynatrace_notebook',\n  'Create Dynatrace Notebook',\n  'Create a new notebook in the Dynatrace platform ...',\n  {\n    name: z.string().describe(/* ... */),\n    description: z.string().optional().describe(/* ... */),\n    content: z.array(z.object({\n      type: z.enum(['dql', 'markdown']),\n      text: z.string(),\n    })).describe(/* ... */),\n  },\n  {\n    readOnlyHint: false,\n  },\n  async ({ name, content, description }) =\u003e {\n    const dtClient = await createAuthenticatedHttpClient(allRequiredScopes);\n    const data = await createDynatraceNotebook(dtClient, name, content, description);\n    // No requestHumanApproval() call.\n    // No destructiveHint annotation.\n    // Scopes requested are allRequiredScopes (the broadest possible set)\n    // even though only document:documents:write is needed.\n\n    return data\n      ? `Document created successfully: ${dtEnvironment}/ui/apps/dynatrace.notebooks/notebook/${data.id}`\n      : 'document creation failed';\n  },\n);\n```\n\nBy comparison, every other write tool calls `requestHumanApproval()` as its first action:\n\n- `send_email` (line 1274): `const approved = await requestHumanApproval(...);`\n- `send_slack_message` (line 652): `const approved = await requestHumanApproval(...);`\n- `send_event` (line 1367): `const approved = await requestHumanApproval(...);`\n- `create_workflow_for_notification` (line 1069): `const approved = await requestHumanApproval(...);`\n- `make_workflow_public` (line 1118): `const approved = await requestHumanApproval(...);`\n\n### PoC\nTested end-to-end against a real Dynatrace tenant. The MCP server was started in HTTP mode with the operator's Platform Token:\n\n```bash\nexport DT_ENVIRONMENT=https://\u003ctenant\u003e.apps.dynatrace.com\nexport DT_PLATFORM_TOKEN=dt0s16....\nnpx -y @dynatrace-oss/dynatrace-mcp-server@1.8.5 --http --port 3000\n```\n\nA single unauthenticated POST from a process with no Dynatrace credentials of its own:\n\n```bash\ncurl -sS http://127.0.0.1:3000/ \\\n  -H 'Content-Type: application/json' \\\n  -H 'Accept: application/json, text/event-stream' \\\n  -d '{\n    \"jsonrpc\": \"2.0\", \"id\": 1, \"method\": \"tools/call\",\n    \"params\": {\n      \"name\": \"create_dynatrace_notebook\",\n      \"arguments\": {\n        \"name\": \"Unapproved notebook\",\n        \"description\": \"Created without operator approval.\",\n        \"content\": [\n          {\"type\": \"markdown\", \"text\": \"# This notebook was created without approval\"},\n          {\"type\": \"dql\",      \"text\": \"fetch logs | limit 10\"}\n        ]\n      }\n    }\n  }'\n```\n\nThe response:\n\n```\nevent: message\ndata: {\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"Document created successfully:\n       https://\u003ctenant\u003e.apps.dynatrace.com/ui/apps/dynatrace.notebooks/notebook/\u003cuuid\u003e\"}]},\n       \"jsonrpc\":\"2.0\",\"id\":1}\n```\n\nThe notebook is visible in the operator's Notebooks app within seconds. No elicitation prompt was sent to any operator client.\n\nBy contrast, the same harness invoking `send_email` or `send_slack_message` returns:\n\n```\n\"Operation cancelled: Human approval was not granted for sending this email.\"\n```\n\nThe gate logic exists and is wired up for all other write tools - it is simply missing on `create_dynatrace_notebook`.\n\n### Impact\n- A caller (an unauthenticated network attacker over the HTTP transport when authentication is missing, or a prompt-injected LLM in stdio mode) can silently create persistent tenant-visible documents.\n- The notebook content is attacker-controlled. Embedded DQL queries execute under the permissions of any tenant user who later opens the notebook - a stored-DQL pattern that crosses identity boundaries within the tenant.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate","id":"GHSA-pc2w-4mq8-32qw","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["1.8.7"],"introduced":["0"],"last_affected":[],"package":"@dynatrace-oss/dynatrace-mcp-server","purl":null,"source":"GHSA-pc2w-4mq8-32qw"},{"ecosystem":"npm","fixed":["1.8.7"],"introduced":["0"],"last_affected":[],"package":"@dynatrace-oss/dynatrace-mcp-server","purl":"pkg:npm/%40dynatrace-oss/dynatrace-mcp-server","source":"GHSA-pc2w-4mq8-32qw"}],"products":null,"published":"2026-07-29","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can create persistent Dynatrace notebooks with arbitrary content and embedded queries without operator approval, potentially leading to privilege escalation when other users open them.","url":"https://insights.sbomify.com/GHSA-pc2w-4mq8-32qw/"}