GHSA-pc2w-4mq8-32qw: @dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
Summary
The `create_dynatrace_notebook` tool in @dynatrace-oss/dynatrace-mcp-server is missing a human-approval gate that should require operator consent before executing. Unlike five other write tools in the same library, this tool allows anyone to create persistent notebooks with arbitrary content (including embedded DQL queries that execute under other users' permissions) without any confirmation from the system operator.
Classification
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-pc2w-4mq8-32qw
First tracked: July 29, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 85%