{"uuid": "23252d05-8a8d-4d51-a08e-4cf3c53a7a34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-PC2W-4MQ8-32QW", "type": "seen", "source": "https://gist.github.com/alon710/fcc454540fcb39a9b7c00ee410e47a9e", "content": "# GHSA-PC2W-4MQ8-32QW: GHSA-PC2W-4MQ8-32QW: Missing Human-Approval Gate in create_dynatrace_notebook\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/GHSA-PC2W-4MQ8-32QW\n\n## Summary\nA logic vulnerability exists in @dynatrace-oss/dynatrace-mcp-server prior to version 1.8.7. The create_dynatrace_notebook tool lacks a human-approval gate, allowing an attacker to exploit indirect prompt injection to force the underlying LLM client to create persistent Dynatrace notebooks without the operator's consent.\n\n## TL;DR\n@dynatrace-oss/dynatrace-mcp-server prior to 1.8.7 lacks a human-approval gate for create_dynatrace_notebook, enabling silent notebook creation via prompt injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (Indirect Prompt Injection)\n- **CVSS Score**: 6.5 (Qualitative Medium-to-High)\n- **Impact**: Unauthorized Creation of Dynatrace Notebooks\n- **Exploit Status**: Proof-of-Concept / Analytical\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @dynatrace-oss/dynatrace-mcp-server\n- **@dynatrace-oss/dynatrace-mcp-server**: < 1.8.7 (Fixed in: `1.8.7`)\n\n## Mitigation\n\n- Upgrade the @dynatrace-oss/dynatrace-mcp-server package to version 1.8.7 or later.\n- Strip notebooks.write permissions from the API tokens used by the MCP server as a temporary workaround.\n- Configure client-side orchestrators to block or filter the create_dynatrace_notebook tool until patched.\n\n**Remediation Steps:**\n1. Run 'npm install @dynatrace-oss/dynatrace-mcp-server@latest' to update the package.\n2. Verify that the installed version in package.json is 1.8.7 or higher.\n3. Restart the MCP server and host orchestrator clients to apply the new tool configuration.\n4. Test execution to verify that a manual confirmation prompt is triggered before notebook creation.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-PC2W-4MQ8-32QW)\n- [GitHub Pull Request #529](https://github.com/dynatrace-oss/dynatrace-mcp/pull/529)\n- [GitHub Fix Commit](https://github.com/dynatrace-oss/dynatrace-mcp/commit/2851d3ce29d834c93b67f0db903c10e0b488e7ac)\n- [GitHub Release tag v1.8.7](https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v1.8.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PC2W-4MQ8-32QW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T11:31:05.843762Z"}