1 matches found
GHSA-P7W7-4929-VPJ5 `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Summary @dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode --http flag that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an...
7.5CVSS6AI score
SaveExploits0References5
20