DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-XRMJ-5G4G-8987: GHSA-xrmj-5g4g-8987: Workflow Template Injection in @dynatrace-oss/dynatrace-mcp-server

#security #cve #cybersecurity #ghsa

GHSA-xrmj-5g4g-8987: Workflow Template Injection in @dynatrace-oss/dynatrace-mcp-server

Vulnerability ID: GHSA-XRMJ-5G4G-8987
CVSS Score: 4.2
Published: 2026-07-31

A template injection vulnerability in @dynatrace-oss/dynatrace-mcp-server allows untrusted input to be interpolated directly into Dynatrace Workflows using Jinja2 syntax, leading to persistent data exposure and exfiltration.

TL;DR

The @dynatrace-oss/dynatrace-mcp-server before v2.0.0 allowed attackers to perform template injection into Dynatrace Workflow templates. This allows arbitrary Jinja2 template execution that persists on the tenant even after the session ends.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1336
  • Attack Vector: Network
  • CVSS v3.1: 4.2
  • Exploit Status: poc
  • KEV Status: Not Listed
  • Weakness Name: Improper Neutralization of Special Elements Used in a Template Engine

Affected Systems

  • @dynatrace-oss/dynatrace-mcp-server
  • @dynatrace-oss/dynatrace-mcp-server: < 2.0.0 (Fixed in: 2.0.0)

Code Analysis

Commit: 64dfcb1

Remove workflow generation tools to eliminate template injection surface

@@ -1,18 +0,0 @@\n-let notificationWorkflow: WorkflowCreate = {\n-  title: "`[MCP POC] Notify team ${teamName} on problem of type ${problemType}`,\n-  description: "`Automatically created workflow to notify team ${teamName}...`,\n-  isPrivate: isPrivate,\n-  type: 'SIMPLE',\n-  tasks: {\n-    send_notification: {\n-      name: 'Send notification',\n-      action: 'dynatrace.slack:slack-send-message',\n-      description: 'Sends a notification to a Slack channel',\n-      input: {\n-        connectionId: 'slack-connection-id',\n-        channel: `{{ \"${channel}\" }}`,\n-        message: `🚨 Alert for Team ${teamName}\n*Problem Type*: ${problemType}\n` +\n-                 `*Problem ID*: {{ event()[\"display_id\"] }}\n` +\n-                 `*Status*: {{ event()[\"event.status\"] }}\n`\n-      },\n-      active: true,\n-    },\n-  },\n-};\""
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Completely decommission the create_workflow_for_notification and make_workflow_public capabilities by upgrading the package to v2.0.0.
  • Audit active workflows in the Dynatrace UI to identify and delete any workflows created by the MCP server containing injected Jinja2 payloads.
  • Implement strong human-in-the-loop review guidelines to examine literal templating syntax during tool execution confirmations.

Remediation Steps:

  1. Run 'npm install @dynatrace-oss/dynatrace-mcp-server@latest' to update the MCP server to a patched release (2.0.0 or higher).
  2. Restart the MCP server daemon to ensure that older, vulnerable capabilities are no longer exposed to LLM clients.
  3. Retrieve the list of active workflows from the Dynatrace Automation API and search for '[MCP POC]' strings in the workflow titles.
  4. Analyze the parameters of existing alert workflows for curly-brace structures such as '{{ event() }}' or '{{ environment() }}' and delete any unauthorized entries.

References

Read the full report for GHSA-XRMJ-5G4G-8987 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)