PT-2026-127224
CVE-2026-116691
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
MLflow versions 2.19.0 through 3.16.x
Description
MLflow leaks CrewAI LLM provider API keys into trace telemetry when
mlflow.crewai.autolog() is enabled. The issue occurs because MLflow serializes the dict of CrewAI Agent objects and converts fields to strings without consistent sanitization. Specifically, the llm field contains a CrewAI LLM object whose string representation includes the api key in plaintext.There are two independent leakage paths:
- Agent span attributes are exposed via the
get agent attributes()function, which fails to sanitize credential-bearing objects such asllm,function calling llm,agent executor, andcrew. - Span inputs are exposed via the
construct full inputs()function, which automatically expands arbitrary objects throughdictwhen they are passed as call arguments.
As a result, plaintext provider credentials can be sent to the MLflow trace backend or a configured OTLP (OpenTelemetry Protocol) destination, where they can be accessed by trace readers.
Recommendations
Upgrade to MLflow version 3.17.0 or later.
Rotate any LLM provider keys used while
mlflow.crewai.autolog() was enabled on versions 2.19.0 through 3.16.x.
Delete or redact affected traces in the MLflow tracking backend and any OTLP destinations.
As a temporary workaround, disable CrewAI autologging by calling mlflow.crewai.autolog(disable=True). Found an issue in the description? Have something to add? Feel free to write us 👾