THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-pqh8-p93p-2rx7 (medium) — @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

[GHSA] GHSA-pqh8-p93p-2rx7 (medium) — @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

highgithub_advisoriesPublished 2026-07-31

GHSA-pqh8-p93p-2rx7 Severity: medium CVE: None

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

### Summary A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers.

### Details Several tools interpo

MITRE ATT&CK techniques

VulnerabilitiesT1588.006

Indicators of compromise

https://docs.dynatrace.com/docs/discover-dynatrace/platform/grail/dynatrace-query-language/dql-referenceurl

Original source: https://github.com/advisories/GHSA-pqh8-p93p-2rx7