{"data":{"id":"d18dbbf0-6c27-4bfe-9241-65c9cb9dc6fc","title":"GHSA-xrmj-5g4g-8987: @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification","summary":"The @dynatrace-oss/dynatrace-mcp-server tool create_workflow_for_notification interpolates the caller-supplied teamName, problemType and channel parameters directly into a Dynatrace Workflow definition, so Jinja2 expressions in them are evaluated at workflow runtime. A caller can use this to serialise event data into a Slack message sent to attacker-chosen destinations, and the resulting workflow persists in the tenant after the MCP session, credentials and server are gone.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-xrmj-5g4g-8987","publishedAt":"2026-07-31T16:01:07.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["@dynatrace-oss/dynatrace-mcp-server@< 2.0.0 (fixed: 2.0.0)"],"affectedPackageNames":["@dynatrace-oss/dynatrace-mcp-server"],"affectedPackageRefs":["npm:@dynatrace-oss/dynatrace-mcp-server"],"affectedVendors":[],"affectedVendorsRaw":["Dynatrace MCP server","Dynatrace Workflows","Model Context Protocol (MCP)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-xrmj-5g4g-8987"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-31T16:01:07.000Z","fixReleasedAt":"2026-06-16T18:25:51.000Z","daysToFix":-45,"fixCheckedAt":"2026-10-29T21:32:30.518Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@dynatrace-oss/dynatrace-mcp-server","fixedVersion":"2.0.0","matchedVersion":"2.0.0","fixReleasedAt":"2026-06-16T18:25:51.000Z","daysToFix":-45,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:30.369Z"}]}}