GHSA-xrmj-5g4g-8987: @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

Summary

The @dynatrace-oss/dynatrace-mcp-server tool create_workflow_for_notification interpolates the caller-supplied teamName, problemType and channel parameters directly into a Dynatrace Workflow definition, so Jinja2 expressions in them are evaluated at workflow runtime. A caller can use this to serialise event data into a Slack message sent to attacker-chosen destinations, and the resulting workflow persists in the tenant after the MCP session, credentials and server are gone.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database