PT-2026-127750

تاريخ النشر

2026-10-27

·

تاريخ التحديث

2026-10-27

الوصف من

CVSS 3.1
6.5
متوسطة
المقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

mlflow.crewai.autolog() leaks CrewAI LLM provider API keys into MLflow trace telemetry.
When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representation includes its api key in plaintext.
As a result, an application that calls mlflow.crewai.autolog() can unintentionally send its LLM provider API key to the MLflow trace backend or configured OTLP destination.
The application does not need to explicitly log the credential or place it in a span attribute. The credential is extracted automatically by MLflow's instrumentation.
This was verified on MLflow 3.16.0 with CrewAI 1.15.18 using MLflow's own OTLP exporter. The fake credential appeared in 5 attribute locations across 2 spans.

Details

The primary issue is in:
mlflow/crewai/autolog.py:: get agent attributes()
The function walks the CrewAI Agent. dict and converts agent fields to strings. tools and embedder receive special handling, but credential-bearing objects such as the following are not sanitized:
  • llm
  • function calling llm
  • agent executor
  • crew
For example, agent.llm is a CrewAI LLM object. In CrewAI 1.15.18, the underlying LLM model contains api key as a normal field. Its string representation therefore contains the credential:
text
llm type='openai' model='gpt-4.1-mini' ... api key='sk-proj-...' ...
MLflow subsequently stores this string as a span attribute.
There is an important indication that this is an unintended disclosure: MLflow's dedicated LLM attribute extraction already explicitly excludes api key in get llm attributes(). The LLM span therefore does not expose the credential, while the broader Agent dict serialization bypasses that protection.
There is also a second, independent serialization path in:
mlflow/crewai/autolog.py:: construct full inputs()
This code uses:
python
v. dict  if hasattr(v, " dict ") else v
on call arguments. During CrewAI execution, the Agent object is passed as an argument, causing its dict to be expanded and the credential-bearing LLM object to be included in mlflow.spanInputs.
Therefore, there are two independent leakage paths:
  1. Agent span attributes through get agent attributes()
  2. Span inputs through construct full inputs()
Fixing only the Agent attribute serialization would leave the mlflow.spanInputs path vulnerable.
A safer approach would be to avoid recursively serializing arbitrary object dict values. Agent telemetry should use an explicit allowlist of non-sensitive scalar fields, and credential-bearing objects such as llm, function calling llm, agent executor, and crew should either be reduced to safe metadata or omitted.
Similarly, construct full inputs() should not automatically expand arbitrary objects through dict, or the resulting values should pass through the same sanitization mechanism before being attached to a span.

PoC

Environment:
text
MLflow: 3.16.0
CrewAI: 1.15.18
Python: 3.12.3
opentelemetry-exporter-otlp-proto-http: 1.42.1

1. Direct serialization proof

The following demonstrates the vulnerability without starting a Crew, making a network request, or requiring an MLflow server:
python
import importlib
from crewai import LLM, Agent

autolog = importlib.import module("mlflow.crewai.autolog")

llm = LLM(
  model="gpt-4.1-mini",
  api key="sk-proj-EXAMPLE1234567890",
)

agent = Agent(
  role="r",
  goal="g",
  backstory="b",
  llm=llm,
)

attrs = autolog. get agent attributes(agent)

assert "sk-proj-EXAMPLE1234567890" in attrs["llm"]

print(attrs["llm"])
The output contains the API key in plaintext, for example:
text
llm type='openai' model='gpt-4.1-mini' ... api key='sk-proj-EXAMPLE1234567890' ...
No provider request is required.

2. End-to-end trace disclosure

The issue can also be reproduced through MLflow's actual OTLP exporter.
Configure a local OTLP HTTP receiver and set:
bash
export OTEL EXPORTER OTLP TRACES ENDPOINT=http://127.0.0.1:4318/v1/traces
export OTEL EXPORTER OTLP TRACES PROTOCOL=http/protobuf
export CREWAI DISABLE TELEMETRY=true
Then run:
python
import mlflow

from crewai import Agent, Crew, LLM, Task

mlflow.crewai.autolog()

llm = LLM(
  model="gpt-4.1-mini",
  api key="sk-proj-EXAMPLE1234567890",
)

agent = Agent(
  role="Support Responder",
  goal="Answer support questions",
  backstory="A support agent",
  llm=llm,
)

task = Task(
  description="Answer the user's question",
  expected output="A response",
  agent=agent,
)

crew = Crew(
  agents=[agent],
  tasks=[task],
)

crew.kickoff()
A local OTLP receiver can decode the ExportTraceServiceRequest sent by MLflow.
The provider request is expected to fail because the credential is intentionally fake. This does not affect the vulnerability: the sensitive value is added to the MLflow span when the instrumentation starts, before the provider call succeeds or fails.
In the tested environment, the fake API key appeared in the exported telemetry in 5 locations across 2 spans, including:
text
Support Responder
 attributes.llm
 attributes.function calling llm
 attributes.agent executor
 attributes.mlflow.spanInputs

Task.execute sync
 attributes.mlflow.spanInputs
The captured value is produced by MLflow's actual telemetry/export path rather than being manually inserted into a span.
All credentials used in the reproduction are locally generated fake values. No real API credential is required.

Impact

Type: Sensitive Information Disclosure / Credential Disclosure CWE: CWE-532 — Insertion of Sensitive Information into Log File
Any application using mlflow.crewai.autolog() with a CrewAI LLM configured with an API key can unintentionally disclose that credential through MLflow traces.
The credential is written to trace telemetry even though the application does not explicitly log it.
Anyone with access to the MLflow trace storage or configured OTLP destination may therefore obtain the provider credential. Depending on the deployment, this can include MLflow users, observability operators, or third-party telemetry providers.
The leaked credential can then potentially be used against the corresponding LLM provider account, including for unauthorized API usage and associated costs.
The issue is particularly significant because the credential crosses a trust boundary: a provider API key intended for use by the application is automatically copied into observability telemetry where a broader set of users or systems may have access.
The vulnerability does not require the developer to intentionally log the secret. The only relevant prerequisite is enabling the CrewAI autologging integration.

Patches

Fixed in MLflow 3.17.0 by #25845. mlflow.crewai.autolog() now reduces CrewAI LLM objects to their model name and drops credential-like keys before they are written to span attributes or mlflow.spanInputs.

Remediation

  • Upgrade to mlflow>=3.17.0.
  • Upgrading stops new leakage but does not remove credentials already written. Rotate any LLM provider key that a CrewAI LLM object held (for example one passed as LLM(api key=...)) while mlflow.crewai.autolog() was enabled on MLflow 2.19.0 through 3.16.x.
  • Delete or redact the affected traces in the MLflow tracking backend and in any OTLP destination they were exported to. The key appears in Agent and Crew span attributes and in mlflow.spanInputs.

Workarounds

If you cannot upgrade yet, disable CrewAI autologging with mlflow.crewai.autolog(disable=True).
قابلية الاستغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
تصنيف نقاط الضعف
CWE-312: Cleartext Storage of Sensitive Information
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-532: Insertion of Sensitive Information into Log File
المعرّفات ذات الصلة
GHSA-J7QQ-VR8C-XVW3
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
dbugs@ptsecurity.com