Security incident · CVE-2026-116691
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
Published Oct 27, 2026 · catalog updated Oct 27, 2026 · MLflow CrewAI autologging records
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116691. EPSS is 0.21%. Act only if a listed version of MLflow CrewAI autologging records is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (MLflow CrewAI autologging records).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium6.5
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.21%
- Remediation
- Version ranges on file
- Affected products
- PyPI mlflow · pip mlflow · pypi mlflow
### Summary leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI is instrumented with MLflow autologging, MLflow serializes the agent's and converts its fields to strings. The field contains the CrewAI LLM object, whose string representation includes its in plaintext. As a result, an application that calls can unintentionally send its LLM provider API key to the MLflow trace backend or configured OTLP destination. The application does not need to explicitly log the credential or place it in a span attribute. The credential is extracted automatically by MLflow's instrumentation. This was verified on **MLflow 3.16.0** with **CrewAI 1.15.18** using MLflow's own OTLP exporter. The fake credential appeared in **5 attribute locations across 2 spans**. ### Details The primary issue is in: The function walks the CrewAI and converts agent fields to strings. and receive special handling, but credential-bearing objects such as the following are not sanitized: * * * * For example, is a CrewAI object. In CrewAI 1.15.18, the underlying LLM model contains as a normal field. Its string representation therefore contains the credential: MLflow subsequently stores this string as a span attribute. There is an important indication that this is an unintended disclosure: MLflow's dedicated LLM attribute extraction already explicitly excludes in . The LLM span therefore does not expose the credential, while the broader Agent serialization bypasses that protection. There is also a second, independent serialization path in: This code uses: on call arguments. During CrewAI execution, the object is passed as an argument, causing its to be expanded and the credential-bearing LLM object to be included in . Therefore, there are two independent leakage paths: 1. **Agent span attributes** through 2. **Span inputs** through Fixing only the Agent attribute serialization would leave the path vulnerable. A safer approach would be to avoid recursively serializing arbitrary objec
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI mlflow2.19.0 → 3.17.0
- pip mlflow>= 2.19.0, < 3.17.0
- pypi mlflow>=2.19.0,<3.17.0
How to fix CVE-2026-116691
Upgrade
CVE-2026-116691 lists a fix boundary at 3.17.0. Compare the installed build with that boundary before you change production.
Version check
Affected < 3.17.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116691. EPSS is 0.21%. Act only if a listed version of MLflow CrewAI autologging records is installed.
Which versions are affected?
Compare what you have installed with 2.19.0 → 3.17.0, >= 2.19.0, < 3.17.0, >=2.19.0,<3.17.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-200: Exposure of Sensitive Information; CWE-312: Cleartext Storage of Sensitive Information; CWE-532: Insertion of Sensitive Information into Log File. EPSS 0.21%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · GitHub Advisory Database
Detected
### Summary leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI is instrumented with MLflow autologging, MLflow serializes the agent's and converts its fields to strings. The field contains the CrewAI LLM object, whose string representation includes its in plaintext. As a result, an application that calls can unintentionally send its LLM provider API key to the MLflow tra
Oct 27, 2026 · GitHub Advisory Database
Fix available
mlflow fixed in 3.17.0
Oct 27, 2026 · GitHub Advisory Database
Fix available
mlflow fixed in 3.17.0
Oct 27, 2026 · GitHub Advisory Database
Updated
### Summary leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI is instrumented with MLflow autologging, MLflow serializes the agent's and converts its fields to strings. The field contains the CrewAI LLM object, whose string representation includes its in plaintext. As a result, an application that calls can unintentionally send its LLM provider API key to the MLflow tra
Sources
- CVE.orgVulnerability recordCVE-2026-116691
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-116691
30-day exploitation probability 0.21%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-j7qq-vr8c-xvw3
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116691
mlflow.crewai.autolog() leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representation includes its api_key in plaintext. As a result, an application that calls mlflow.crewai.autolog() can unin
advisories.gitlab.com - GitLab Advisory DatabasePackage advisorypypi/mlflow/CVE-2026-116691.yml
leaks CrewAI LLM provider API keys into MLflow + trace telemetry.\n\nWhen a CrewAI is instrumented with MLflow autologging, + MLflow serializes the agent's and converts its fields to strings. The + field contains the CrewAI LLM object, whose string representation includes + its in plaintext.\n\nAs a result, an application that calls + can unintentionally send its LLM provider API key to the MLflow
gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-j7qq-vr8c-xvw3
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
osv.dev - PyPA Advisory DatabasePackage advisoryGHSA-j7qq-vr8c-xvw3
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
osv.dev
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 6, 2026
- GitHub Advisory DatabaseOct 28, 2026
- OpenSSF OSV / OSV ScannerOct 28, 2026
- CVE.orgOct 28, 2026
- PyPA Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026