What happened
CWE-306 missing authentication for critical function. An unauthenticated remote caller can drive the MCP server's tools under the operator's Dynatrace credentials, notably execute_dql for reading Grail observability/security data. CVSS 7.5.
Why it matters
Click '--http' on an MCP observability server and you expose read access to the Dynatrace security/observability data an AI agent is granted — a network-reachable path to the same sensitive telemetry the agent uses, with no authentication.
Attack vector
A server started with --http accepts JSON-RPC tools/call requests with no authentication, session validation, or Host/Origin protection, then dispatches them under the server's configured Dynatrace credentials. A network-reachable caller invokes execute_dql to read logs/security events/user sessions or create_dynatrace_notebook.
Affected systems
dynatrace-oss dynatrace-mcp < 2.0.0
Mitigation
Upgrade to dynatrace-mcp 2.0.0 (GHSA-p7w7-4929-vpj5).