CVE-2026-116691: MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Vulnerability summary

CVE-2026-116691 is a medium (CVSS 6.5) vulnerability in mlflow.

Timeline

1. 27-10-2026
   PublishedVulnerability first disclosed.

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
• CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.