THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-p7w7-4929-vpj5 (high) — `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

[GHSA] GHSA-p7w7-4929-vpj5 (high) — `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

highgithub_advisoriesPublished 2026-07-31

GHSA-p7w7-4929-vpj5 Severity: high CVE: None

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

### Summary

`@dynatrace-oss/dynatrace-mcp-server` v1.8.5 exposes an HTTP transport mode (`--http` flag) that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSO

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

https://abc12345.apps.dynatrace.comurl
http://127.0.0.1:3999/url
http://{HOST}:{PORT}/url

Original source: https://github.com/advisories/GHSA-p7w7-4929-vpj5