GHSA-xrmj-5g4g-8987: @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
A template injection vulnerability in the create_workflow_for_notification tool lets a caller embed Jinja2 expressions that the Dynatrace workflow engine evaluates at runtime, exfiltrating event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends.
References
- github.com/advisories/GHSA-xrmj-5g4g-8987
- github.com/dynatrace-oss/dynatrace-mcp/commit/64dfcb1095823d0fb43013635446288a6ff60e29
- github.com/dynatrace-oss/dynatrace-mcp/pull/547
- github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0
- github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-xrmj-5g4g-8987
Code Behaviors & Features
Detect and mitigate GHSA-xrmj-5g4g-8987 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →