{"id":8889,"date":"2026-11-13T16:17:50","date_gmt":"2026-11-13T16:17:50","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server"},"modified":"2026-11-13T16:17:50","modified_gmt":"2026-11-13T16:17:50","slug":"cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server","title":{"rendered":"CVE-2026-123809: Jinja2 Template Injection in Dynatrace MCP Server"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> CVE-2026-123809 is a Jinja2 template injection vulnerability in the Dynatrace MCP Server&#8217;s create_workflow_for_notification tool that allows attackers to embed expressions evaluated at workflow runtime.<\/li><li><strong>Who is affected:<\/strong> Users of Dynatrace MCP Server versions up to and including 1.8.5 who use the create_workflow_for_notification tool.<\/li><li><strong>Severity:<\/strong> Medium (CVSS 4.2).<\/li><li><strong>Fixed in:<\/strong> Version 2.0.0, which removes the vulnerable create_workflow_for_notification and make_workflow_public tools entirely.<\/li><li><strong>What to do:<\/strong> Upgrade to version 2.0.0 or later, and manually delete any workflows created by the vulnerable tool from your Dynatrace tenant.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Dynatrace MCP Server is a tool that connects AI assistants to Dynatrace monitoring systems. A security flaw in one of its features allowed attackers to sneak malicious code into automated workflows. When these workflows ran, they could send sensitive monitoring data to channels controlled by the attacker. The dangerous part is that these workflows stayed active in the system even after the original session ended, continuing to leak data until someone manually deleted them. The company fixed this by removing the vulnerable feature entirely in version 2.0.0. If you use this tool, you should upgrade and check your Dynatrace account for any suspicious workflows that might still be running.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The create_workflow_for_notification tool in Dynatrace MCP Server inserted caller-controlled values for teamName, problemType, and channel directly into Dynatrace workflow definitions without sanitizing Jinja2 template expressions. According to the GitHub security advisory, a caller could place template expressions such as <code>{{ event() }}<\/code> in those values, and the Dynatrace workflow engine would evaluate them at runtime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerable code was located in src\/capabilities\/create-workflow-for-problem-notification.ts, lines 82\u201399, where the tool interpolated three caller-supplied parameters directly into a WorkflowCreate object. The action used was dynatrace.slack:slack-send-message, which evaluates Jinja2 expressions in its inputs at workflow runtime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory includes a proof-of-concept demonstration against a real Dynatrace tenant. When a workflow was created with <code>teamName: &quot;{{ event() }}&quot;<\/code>, the workflow engine evaluated the injected expression at runtime. The execution log showed the Input tab contained the actual event object in place of the template expression. The Slack action failed only because the workflow used a hardcoded placeholder connectionId that did not resolve to any real connection. With a valid Slack connector, the message would have been delivered with serialized event data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The workflows created by this tool were persistent, remaining in the tenant after the MCP session ended, after the operator&#8217;s credentials were revoked, and after the MCP server was uninstalled. They fired on every matching problem until manually deleted from the Workflows app. The isPrivate parameter defaulted to false, making created workflows visible tenant-wide unless explicitly set otherwise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The approval prompt rendered template expressions literally to the operator with no indication they would be evaluated, and did not surface the workflow&#8217;s visibility setting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to Dynatrace MCP Server version 2.0.0 or later. The fix removes the create_workflow_for_notification and make_workflow_public tools entirely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Manually review and delete any workflows in your Dynatrace tenant that were created by the vulnerable tool. These workflows persist after upgrade and will continue to fire on matching problems until manually removed. The advisory states that workflows remain active after the MCP session ends, after credentials are revoked, and after the MCP server is uninstalled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you relied on the removed tool, the changelog recommends creating Dynatrace workflows manually via the Dynatrace UI, dtctl, or the Automations API.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability demonstrates the risks of template injection in AI agent tooling. The Dynatrace MCP Server is an MCP (Model Context Protocol) server that provides AI assistants with tools to interact with Dynatrace observability data. The create_workflow_for_notification tool was designed to automate the creation of notification workflows, but its lack of input sanitization allowed attackers to inject code that would execute in a different security context.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The persistence of the malicious workflows is particularly concerning. Unlike typical injection attacks that end when a session closes, these workflows remained active indefinitely, creating a long-lived exfiltration channel. The default visibility setting (tenant-wide) amplified the impact.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The CVSS score of 4.2 reflects the fact that exploitation requires the attacker to have MCP access and the operator to approve the workflow creation, but the potential for data exfiltration and the persistence of the attack vector make this a significant security issue for affected deployments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dynatrace&#8217;s response was to remove the vulnerable functionality entirely rather than attempt to sanitize inputs, which is a conservative approach that eliminates the attack surface. Users who need similar functionality are directed to more robust alternatives like dtctl or the Automations API.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-123809\" target=\"_blank\" rel=\"noreferrer noopener\">NVD: CVE-2026-123809<\/a><\/li><li><a href=\"https:\/\/github.com\/dynatrace-oss\/dynatrace-mcp\/security\/advisories\/GHSA-xrmj-5g4g-8987\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-xrmj-5g4g-8987<\/a><\/li><li><a href=\"https:\/\/github.com\/dynatrace-oss\/dynatrace-mcp\/releases\/tag\/v2.0.0\" target=\"_blank\" rel=\"noreferrer noopener\">Dynatrace MCP Server v2.0.0 Release Notes<\/a><\/li><li><a href=\"https:\/\/github.com\/dynatrace-oss\/dynatrace-mcp\/commit\/8f975d6f6713b6da803aa1b602c9f68c8a6ec02a\" target=\"_blank\" rel=\"noreferrer noopener\">Commit 8f975d6: Remove create_workflow_for_notification tool<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A template injection flaw in the Dynatrace MCP Server&#8217;s create_workflow_for_notification tool lets attackers embed Jinja2 expressions that exfiltrate event data to attacker-controlled Slack channels. The malicious workflows persist after the MCP session ends.<\/p>\n","protected":false},"author":2,"featured_media":8888,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"Dynatrace MCP Server versions up to and including 1.8.5","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Template Injection Lets Attackers Exfiltrate Data via Persistent Workflows","_nx_sec_type":"mcp","_nx_sec_vendor":"Dynatrace","_nx_sec_fixed":"2.0.0","_nx_sec_action":""},"categories":[65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8889","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-123809: Dynatrace MCP Server Template Injection<\/title>\n<meta name=\"description\" content=\"CVE-2026-123809 allows attackers to inject Jinja2 expressions into Dynatrace MCP Server workflows, exfiltrating event data to attacker-controlled channels.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-123809: Dynatrace MCP Server Template Injection\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-123809 allows attackers to inject Jinja2 expressions into Dynatrace MCP Server workflows, exfiltrating event data to attacker-controlled channels.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T16:17:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-123809: Jinja2 Template Injection in Dynatrace MCP Server\",\"datePublished\":\"2026-11-13T16:17:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\"},\"wordCount\":806,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp\",\"articleSection\":[\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T16:17:50+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\",\"name\":\"CVE-2026-123809: Dynatrace MCP Server Template Injection\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp\",\"datePublished\":\"2026-11-13T16:17:50+00:00\",\"description\":\"CVE-2026-123809 allows attackers to inject Jinja2 expressions into Dynatrace MCP Server workflows, exfiltrating event data to attacker-controlled channels.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-123809: Jinja2 Template Injection in Dynatrace MCP Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-123809: Dynatrace MCP Server Template Injection","description":"CVE-2026-123809 allows attackers to inject Jinja2 expressions into Dynatrace MCP Server workflows, exfiltrating event data to attacker-controlled channels.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-123809: Dynatrace MCP Server Template Injection","og_description":"CVE-2026-123809 allows attackers to inject Jinja2 expressions into Dynatrace MCP Server workflows, exfiltrating event data to attacker-controlled channels.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server","og_site_name":"i10X News","article_published_time":"2026-11-13T16:17:50+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-123809: Jinja2 Template Injection in Dynatrace MCP Server","datePublished":"2026-11-13T16:17:50+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server"},"wordCount":806,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp","articleSection":["AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T16:17:50+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server","name":"CVE-2026-123809: Dynatrace MCP Server Template Injection","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp","datePublished":"2026-11-13T16:17:50+00:00","description":"CVE-2026-123809 allows attackers to inject Jinja2 expressions into Dynatrace MCP Server workflows, exfiltrating event data to attacker-controlled channels.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-123809-jinja2-template-injection-dynatrace-mcp-server#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-123809: Jinja2 Template Injection in Dynatrace MCP Server"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8889"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8889\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8888"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8889"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8889"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}