Vulnerability · Published Oct 27, 2026 · Assigned by GitHub_M

CVE-2026-116691MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Medium 6.5

In plain English

A medium-severity information exposure in mlflow from mlflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 89.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mlflow	3.17.0	GHSA-j7qq-vr8c-xvw3

Affected products (as reported)

Vendor	Product	Versions
mlflow	mlflow	>= 2.19.0, < 3.17.0

Weakness: CWE-200, CWE-312, CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3 x_refsource_CONFIRM
https://github.com/mlflow/mlflow/pull/25845 x_refsource_MISC
https://github.com/mlflow/mlflow/commit/20927930d27f0072fcfeb7f024f24ad8c5e77c47 x_refsource_MISC
https://github.com/mlflow/mlflow/releases/tag/v3.17.0 x_refsource_MISC