Quick Take
- What: CVE-2026-123810 is a DQL injection vulnerability in Dynatrace MCP Server that lets attackers inject arbitrary query stages through parameters documented as identifiers or timeframes.
- Who is affected: Users of Dynatrace MCP Server versions up to and including 1.8.5.
- What to do: Upgrade to version 2.1.1 or newer.
- Severity: Medium (CVSS 4.3).
- Status: Patch available.
In plain English
Dynatrace MCP Server is a tool that connects AI agents to Dynatrace observability data. A security flaw let someone trick the server into running more powerful database queries than intended. The affected tools were marked as “read-only and safe to auto-approve, but an attacker could inject extra commands to see more data fields or ignore time limits. The flaw did not give access to data the user’s token could not already reach, but it broke the safety promise of the read-only tools.
What you should do: If you use Dynatrace MCP Server, update to version 2.1.1. If you do not use this tool, you can ignore this issue.
What happened
Several read capabilities in Dynatrace MCP Server interpolated caller-controlled values into Dynatrace Query Language (DQL) strings without sufficient validation or escaping. The affected capabilities were find-monitored-entity-by-name.ts, list-problems.ts, list-vulnerabilities.ts, list-exceptions.ts, and get-events-for-cluster.ts. These tools embedded parameters such as entityNames, timeframe, clusterId, and kubernetesEntityId directly into DQL queries.
Crafted parameter values could close string literals, append pipeline stages, or use // line comments to discard the rest of the intended query. For example, an attacker could supply entityNames = ['svc | fields id, name, tags //'] to inject a custom field-selection stage and suppress the tool’s original field list. Similarly, a timeframe value of '30d, to: now() | fieldsAdd internal_secret //' would inject a new pipeline stage before the tool’s intended filter.
The vulnerability allowed callers to bypass the tools’ documented field-scope, time-window, and display caps. The affected tools were annotated readOnlyHint: true, which some MCP clients treat as a signal to auto-approve. The injection turned these “safe” read tools into an arbitrary-DQL surface, breaking the tool contract and the auto-approval pathway.
Dynatrace published security advisory GHSA-pqh8-p93p-2rx7 on June 9, 2026. The advisory notes that the marginal privilege ceiling is low because the operator’s token also exposes execute_dql with full DQL access. The injection does not grant new data access beyond what execute_dql already provides; the impact is the broken tool contract and the auto-approval pathway, not privilege escalation.
What you should do
Upgrade to Dynatrace MCP Server version 2.1.1 or newer. The fix, committed on July 14, 2026, adds a dql-sanitize utility with three guards: validateTimeframe rejects non-duration values, validateAdditionalFilter rejects pipe and newline characters, and escapeDqlStringValue escapes backslashes and double quotes before embedding values in DQL string literals. These guards are applied to all five affected capability files.
What it means
This vulnerability highlights the risk of query-language injection in AI agent frameworks. MCP servers often expose read-only tools that clients may auto-approve based on the readOnlyHint annotation. When these tools interpolate untrusted input into query strings without proper escaping, an attacker (typically via prompt injection of an LLM) can bypass the tool’s documented constraints and access data outside the intended scope. While the Dynatrace flaw did not escalate privileges beyond the user’s existing token, it broke the safety contract of the read-only tools and could be exploited through prompt injection. Developers of MCP servers and similar agent tools should validate and escape all user-supplied parameters before embedding them in query languages.
