Lucene search
+L

3 matches found

osv_ghsa
osv_ghsa
•added 2026/07/31 4:05 p.m.•31 views

GHSA-P7W7-4929-VPJ5 `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

Summary @dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode --http flag that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an...

7.5CVSS6.3AI score0.00239EPSS
SaveExploits0References5
Rows per page
Query Builder