# CVE-2026-123809: Dynatrace MCP Server: Workflow template injection via create_workflow_for_notification

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template expressions such as event() in those values, and the workflow engine evaluates them when the persistent workflow runs. When the workflow has a valid Slack connector, the resulting Slack action can disclose event or tenant metadata to an attacker-selected channel; the shipped placeholder connection does not deliver messages by itself. The workflow remains in the tenant after the MCP session and credentials are gone. The isPrivate option defaults to false, making the created workflow tenant-visible unless the caller changes it. Exploitation requires either an MCP prompt-injection path or an operator approving a prompt that displays the template fragment literally. This issue is fixed in version 2.0.0.

## Remediation

- fix: @dynatrace-oss/dynatrace-mcp-server (npm): OSV reports a fixed version 2.0.0. Check the advisory for supported release branches. (source: OSV GHSA-xrmj-5g4g-8987) — https://github.com/advisories/GHSA-xrmj-5g4g-8987

## Affected products and versions

- dynatrace-oss / dynatrace-mcp: < 2.0.0 (affected). Source: CNA: GitHub_M
-  / @dynatrace-oss/dynatrace-mcp-server (@dynatrace-oss/dynatrace-mcp-server): ≥ 0; < 2.0.0 (affected, semver); OSV events: introduced 0; fixed 2.0.0. Source: OSV GHSA-xrmj-5g4g-8987

## Severity and prioritization

- CVSS 3.1: 4.2 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-1336

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-xrmj-5g4g-8987 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-xrmj-5g4g-8987 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-123809; retrieved 2026-11-09; source updated 2026-11-09

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-xrmj-5g4g-8987; retrieved 2026-11-09; source updated 2026-11-09

Revision: b9201e19bd2117f6081cccb1b808be2d68f003af6c75682ab3ed21b313e4a790

Canonical: https://y2.dev/cve/CVE-2026-123809

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.