CVE-2026-123811

The Dynatrace MCP Server (@dynatrace-oss/dynatrace-mcp-server) is vulnerable to unauthenticated HTTP MCP tool invocation in versions prior to 2.0.0 . When started with the --http flag, the server fails to perform authentication, session validation, or Host/Origin protections. This allows a networ...