CVE-2026-123810 Dynatrace MCP Server: DQL injection via parameters not documented as DQL

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

CVE-2026-123810

The Dynatrace MCP Server (prior to version 2.1.1 ) is vulnerable to DQL injection because several read capabilities interpolate caller-controlled values into Dynatrace Query Language (DQL) strings without sufficient validation or escaping. Specifically, the entityNames parameter in find-monitored...