CVE-2026-123812: Dynatrace MCP: missing approval gate allows notebook writes

LOW

Published November 9, 2026

CISO Take

The Dynatrace MCP Server's create_dynatrace_notebook tool writes persistent notebooks to a tenant without calling requestHumanApproval, the consent gate the project's other write tools use (CWE-862, missing authorization). A caller that can reach the tool, for example an AI agent steered by prompt injection, can plant notebooks with attacker-controlled Markdown or DQL, and tenant users may later run that DQL by opening the notebook. Risk is low: CVSS is 3.7 with high attack complexity and integrity-only impact. There is no public exploit, no Nuclei template, and no KEV listing, and EPSS and SSVC data are unavailable. Upgrade to version 1.8.7, which fixes this, and review which MCP clients and agents can call write tools against your Dynatrace tenants.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Low overall, with a CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N, integrity-only impact). No KEV listing, no public exploit and no scanner template exist, and EPSS is unavailable. Exploitation requires reaching the MCP server's tool interface, typically through an agent that can be manipulated, and the planted DQL runs only if a tenant user opens the notebook. The risk is higher in tenants where the MCP server is wired to autonomous agents that ingest untrusted content. It is also higher where notebooks are widely shared, since planted content gains implicit trust from the tenant's own UI. Observability data is sensitive, so the possible secondary effect is misleading dashboards or unintended data queries when a user runs the DQL. Treat it as a patch-in-cycle item rather than an emergency.

How does the attack unfold?

Initial Access

The attacker reaches the MCP tool interface directly or steers an AI agent via injected content to call create_dynatrace_notebook.

AML.T0053

Exploitation

The tool writes a persistent notebook without calling requestHumanApproval, so no operator consent is requested.

Persistence

The notebook stays visible in the tenant with attacker-controlled Markdown and DQL, which looks like legitimate content.

Impact

A tenant user opens the notebook and runs the embedded DQL, which leads to misleading data or unintended queries.

AML.T0099

Initial Access

The attacker reaches the MCP tool interface directly or steers an AI agent via injected content to call create_dynatrace_notebook.

AML.T0053

Exploitation

The tool writes a persistent notebook without calling requestHumanApproval, so no operator consent is requested.

Persistence

The notebook stays visible in the tenant with attacker-controlled Markdown and DQL, which looks like legitimate content.

Impact

A tenant user opens the notebook and runs the embedded DQL, which leads to misleading data or unintended queries.

AML.T0099

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) Upgrade dynatrace-mcp to version 1.8.7 or later, which adds the approval gate (commit 2851d3c, advisory GHSA-pc2w-4mq8-32qw). 2) Until patched, disable or block the create_dynatrace_notebook tool in MCP client configuration, or restrict the MCP server to read-only tokens and scopes. 3) Issue least-privilege Dynatrace API tokens to the MCP server, without document write scopes unless needed. 4) Require human-in-the-loop confirmation for all write tools in the MCP client. 5) Detection: audit tenant notebooks for unexpected recent creations, review DQL in notebooks authored by the MCP service identity, and monitor Dynatrace audit logs for document-create events from that token.

How is it classified?

Auth BypassPrompt InjectionAgentPluginAPIAML.T0053- AI Agent Tool Invocation AML.T0099- AI Agent Tool Data Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 14-Human oversight

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-123812?

Is CVE-2026-123812 actively exploited?

No confirmed active exploitation of CVE-2026-123812 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123812?

1) Upgrade dynatrace-mcp to version 1.8.7 or later, which adds the approval gate (commit 2851d3c, advisory GHSA-pc2w-4mq8-32qw). 2) Until patched, disable or block the create_dynatrace_notebook tool in MCP client configuration, or restrict the MCP server to read-only tokens and scopes. 3) Issue least-privilege Dynatrace API tokens to the MCP server, without document write scopes unless needed. 4) Require human-in-the-loop confirmation for all write tools in the MCP client. 5) Detection: audit tenant notebooks for unexpected recent creations, review DQL in notebooks authored by the MCP service identity, and monitor Dynatrace audit logs for document-create events from that token.

What systems are affected by CVE-2026-123812?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers and tool integrations, AI-assisted observability and AIOps workflows.

What is the CVSS score for CVE-2026-123812?

CVE-2026-123812 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMCP servers and tool integrationsAI-assisted observability and AIOps workflows

MITRE ATLAS Techniques

AML.T0053AI Agent Tool Invocation

AML.T0099AI Agent Tool Data Poisoning

Compliance Controls Affected

EU AI Act: Art. 14

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

Exploitation Scenario

An attacker plants an indirect prompt injection in content that an engineer's AI assistant reads, such as a ticket, log message or web page. The assistant, connected to the Dynatrace MCP Server, is steered into calling create_dynatrace_notebook. Because no approval prompt appears, a notebook is silently created in the tenant. It has a plausible title such as 'Incident runbook' and contains attacker-controlled Markdown and DQL. A tenant user later opens the notebook during an incident and runs the embedded DQL. This surfaces misleading results or queries sensitive observability data that the attacker wants displayed.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.