CVE-2026-123811: unauthenticated HTTP tool calls

CISO Take

Dynatrace MCP Server before 2.0.0 accepts JSON-RPC tool calls over HTTP with no authentication, session validation, or Host/Origin checks when it is started with the --http option, and it runs those calls under the server's own Dynatrace credentials. Any caller that can reach the port can run arbitrary DQL queries against logs, security events, and user sessions in Grail, or create notebooks visible to the whole tenant. The CVSS score is 7.5 (high). The high complexity and user interaction ratings suggest the realistic path is a browser-based attack, such as DNS rebinding or a malicious web page, against a developer or analyst workstation, but a directly exposed port is also exploitable. There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data, so mass exploitation is not currently evidenced. Because the impact is read access to sensitive observability and security telemetry, treat it as a priority for any team that runs this server in HTTP mode. Upgrade to 2.0.0 now, and until then run the server over stdio or bind it strictly to localhost behind an authenticating proxy.

Sources:NVDGitHub AdvisoryATLASdynatrace-oss/dynatrace-mcp GitHub repository

What is the risk?

Rated high (CVSS 3.1: 7.5). Exploitation needs no privileges, but the attack complexity is high and a user must take an action, which points to browser-mediated attacks (DNS rebinding, cross-origin requests to localhost) or to adversaries who already have network reach to the HTTP listener. The scope is changed because the MCP server acts with Dynatrace credentials the caller never held. Confidentiality impact is high (logs, security events, user sessions), and integrity and availability impacts are low (notebook creation, query load). The send_event path is gated by human approval and is not affected. There is no known active exploitation, no public exploit code, and no EPSS signal, so likelihood is moderate. Exposure depends heavily on whether teams run the server with --http, and on whether it is bound to localhost or to a shared network interface.

How does the attack unfold?

Initial Access

The attacker reaches the unauthenticated MCP HTTP endpoint directly or through a victim's browser using DNS rebinding or a cross-origin request.

AML.T0049

Tool Invocation

The attacker sends JSON-RPC tools/call requests that the server runs under its configured Dynatrace credentials, with no session, Host, or Origin check.

AML.T0053

Collection

The attacker runs execute_dql to read logs, security events, user sessions, and other Grail data.

AML.T0085.001

Impact

Sensitive telemetry is exfiltrated, and attacker-created notebooks in the tenant can mislead other users.

AML.T0048

Initial Access

The attacker reaches the unauthenticated MCP HTTP endpoint directly or through a victim's browser using DNS rebinding or a cross-origin request.

AML.T0049

Tool Invocation

The attacker sends JSON-RPC tools/call requests that the server runs under its configured Dynatrace credentials, with no session, Host, or Origin check.

AML.T0053

Collection

The attacker runs execute_dql to read logs, security events, user sessions, and other Grail data.

AML.T0085.001

Impact

Sensitive telemetry is exfiltrated, and attacker-created notebooks in the tenant can mislead other users.

AML.T0048

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SChanged

CHigh

ILow

ALow

What should I do?

1 step

1) Upgrade Dynatrace MCP Server to 2.0.0 or later, which fixes the issue (see the GHSA-p7w7-4929-vpj5 advisory and the v2.0.0 release). 2) Until patched, stop using the --http option and use the stdio transport, or bind the listener to 127.0.0.1 only and put an authenticating reverse proxy in front that enforces Host and Origin allow-lists. 3) Restrict network access to the MCP port with host firewalls or security groups, and never expose it on shared or public interfaces. 4) Reduce the blast radius by giving the server's Dynatrace token or OAuth client the minimum scopes (for example, restrict DQL read scopes and notebook write permissions) and rotate those credentials if exposure is suspected. 5) Detection: review Dynatrace audit logs for unexpected execute_dql activity and for notebooks created by the MCP service identity, and check network logs for inbound connections to the MCP HTTP port from unexpected hosts or browsers. 6) Inventory developer workstations and CI jobs that launch the server with --http.

How is it classified?

Auth BypassData LeakagePluginAgentAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0078- Drive-by Compromise AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-123811?

Dynatrace MCP Server before 2.0.0 accepts JSON-RPC tool calls over HTTP with no authentication, session validation, or Host/Origin checks when it is started with the --http option, and it runs those calls under the server's own Dynatrace credentials. Any caller that can reach the port can run arbitrary DQL queries against logs, security events, and user sessions in Grail, or create notebooks visible to the whole tenant. The CVSS score is 7.5 (high). The high complexity and user interaction ratings suggest the realistic path is a browser-based attack, such as DNS rebinding or a malicious web page, against a developer or analyst workstation, but a directly exposed port is also exploitable. There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data, so mass exploitation is not currently evidenced. Because the impact is read access to sensitive observability and security telemetry, treat it as a priority for any team that runs this server in HTTP mode. Upgrade to 2.0.0 now, and until then run the server over stdio or bind it strictly to localhost behind an authenticating proxy.

Is CVE-2026-123811 actively exploited?

No confirmed active exploitation of CVE-2026-123811 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123811?

1) Upgrade Dynatrace MCP Server to 2.0.0 or later, which fixes the issue (see the GHSA-p7w7-4929-vpj5 advisory and the v2.0.0 release). 2) Until patched, stop using the --http option and use the stdio transport, or bind the listener to 127.0.0.1 only and put an authenticating reverse proxy in front that enforces Host and Origin allow-lists. 3) Restrict network access to the MCP port with host firewalls or security groups, and never expose it on shared or public interfaces. 4) Reduce the blast radius by giving the server's Dynatrace token or OAuth client the minimum scopes (for example, restrict DQL read scopes and notebook write permissions) and rotate those credentials if exposure is suspected. 5) Detection: review Dynatrace audit logs for unexpected execute_dql activity and for notebooks created by the MCP service identity, and check network logs for inbound connections to the MCP HTTP port from unexpected hosts or browsers. 6) Inventory developer workstations and CI jobs that launch the server with --http.

What systems are affected by CVE-2026-123811?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers / tool-calling integrations, observability and AIOps pipelines, developer AI assistants with tool access.

What is the CVSS score for CVE-2026-123811?

CVE-2026-123811 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP servers / tool-calling integrationsobservability and AIOps pipelinesdeveloper AI assistants with tool access

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0078Drive-by Compromise

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrace credentials. A network-reachable caller can invoke execute_dql to read logs, security events, user sessions, and other Grail data, or invoke create_dynatrace_notebook to create tenant-visible notebooks. The send_event path is not affected because its requestHumanApproval gate blocks this attack path, and reset_grail_budget only demonstrates dispatch without accessing Dynatrace data. This issue is fixed in version 2.0.0.

Exploitation Scenario

An engineer runs Dynatrace MCP Server locally with --http so an AI coding assistant can query production telemetry. The engineer visits an attacker-controlled web page. Using DNS rebinding, the page makes the browser send JSON-RPC tools/call requests to the local MCP port, which has no Host or Origin validation and no authentication. The attacker calls execute_dql to pull recent security events, user sessions, and logs that may include tokens or personal data, and sends the results to an external server. The attacker may also call create_dynatrace_notebook to leave a notebook in the tenant that contains a misleading or malicious link for colleagues. The same flow works for an attacker who simply has network access to a server bound to a shared interface.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-306Missing Authentication for Critical Functionality

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.