{"slug": "cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in", "title": "CVE-2026-116691: CVE-2026-116691: Cleartext LLM Provider API Key Disclosure in MLflow CrewAI Autologging", "summary": "MLflow versions 2.19.0 through 3.16.x leak plaintext LLM provider API keys into OpenTelemetry trace spans and MLflow tracking stores when CrewAI autologging is enabled, according to CVE-2026-116691 (GHSA-j7qq-vr8c-xvw3), rated CVSS 6.5. The flaw, CWE-532, stems from mlflow.crewai.autolog() failing to sanitize nested CrewAI LLM objects before serialization; a proof-of-concept is publicly available. MLflow 3.17.0 patches the issue with recursive credential sanitization and LLM object summarization, and users are advised to upgrade and rotate exposed keys.", "body_md": "# \n  \n  \n  CVE-2026-116691: Cleartext LLM Provider API Key Disclosure in MLflow CrewAI Autologging\n\n**Vulnerability ID:** CVE-2026-116691\n\n**CVSS Score:** 6.5\n\n**Published:** 2026-10-27\n\nCVE-2026-116691 (GHSA-j7qq-vr8c-xvw3) is a sensitive credential disclosure vulnerability in the MLflow platform affecting versions 2.19.0 through 3.16.x. When CrewAI autologging is enabled via mlflow.crewai.autolog(), the tracing instrumentation fails to sanitize nested CrewAI LLM objects before serializing them into OpenTelemetry trace spans. Consequently, plaintext LLM provider API keys are extracted from object dictionaries and string representations, then transmitted and stored in MLflow tracking servers or external OpenTelemetry Protocol (OTLP) telemetry backends.\n\n## \n  \n  \n  TL;DR\n\nMLflow versions 2.19.0 to 3.16.x leak plaintext LLM API keys into OpenTelemetry trace attributes and span inputs when mlflow.crewai.autolog() is used with CrewAI agents configured with explicit API keys. Users should upgrade to MLflow 3.17.0 and rotate affected credentials.\n\n### \n  \n  \n  ⚠️ Exploit Status: POC\n\n## \n  \n  \n  Technical Details\n\n- \n**CVE / Advisory ID** : CVE-2026-116691 / GHSA-j7qq-vr8c-xvw3\n- \n**Primary CWE** : CWE-532 (Insertion of Sensitive Information into Log File)\n- \n**CVSS v3.1 Score** : 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n- \n**Attack Vector** : Network (Telemetry / Trace Backend Retrieval)\n- \n**Affected Component** : mlflow.crewai.autolog (mlflow/crewai/autolog.py)\n- \n**Affected Versions** : >= 2.19.0, < 3.17.0\n- \n**Patched Version** : 3.17.0\n- \n**Exploit Status** : Proof-of-Concept Publicly Available; Not in CISA KEV\n\n## \n  \n  \n  Affected Systems\n\n- MLflow (PyPI package: mlflow) versions >= 2.19.0, < 3.17.0 using mlflow.crewai.autolog()\n- \n**mlflow** : >= 2.19.0, < 3.17.0 (Fixed in:`3.17.0` )\n\n## \n  \n  \n  Code Analysis\n\nSanitize CrewAI span attributes, inputs, and outputs to strip LLM credentials and sensitive keys (#25845)\n\n## \n  \n  \n  Exploit Details\n\n- \n[GitHub Security Advisory](https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3) : Official advisory containing both an in-memory serialization reproduction script and an end-to-end OpenTelemetry (OTLP) trace capture proof-of-concept.\n\n## \n  \n  \n  Mitigation Strategies\n\n- Upgrade MLflow to version 3.17.0 or later to enforce recursive credential sanitization and LLM object summarization during span creation.\n- Disable CrewAI autologging via mlflow.crewai.autolog(disable=True) if an immediate package upgrade cannot be performed.\n- Configure LLM provider credentials via environment variables (e.g., OPENAI_API_KEY) rather than passing explicit api_key strings to CrewAI LLM constructors.\n- Audit historical OpenTelemetry trace spans and MLflow tracking stores for exposed credentials, purge affected records, and rotate all compromised LLM API keys.\n\n**Remediation Steps:**\n\n1. Run `pip install --upgrade \"mlflow>=3.17.0\"` across all Python environments, containers, and CI/CD pipelines utilizing MLflow and CrewAI.\n2. Verify the installation by running an in-memory attribute check against `mlflow.crewai.autolog._get_agent_attributes()` to confirm`api_key` strings are omitted.\n3. Search MLflow tracking databases, artifact stores, and downstream OTLP observability backends for regex patterns matching `api_key='...'` or`sk-proj-...` within`attributes.llm` ,`attributes.function_calling_llm` ,`attributes.agent_executor` , and`attributes.mlflow.spanInputs` .\n4. Revoke and regenerate all LLM provider API keys identified in historical traces or used in environments where `mlflow.crewai.autolog()` was active on versions 2.19.0 through 3.16.x.\n5. Delete or redact historical trace spans containing cleartext secrets from the MLflow backend and third-party telemetry platforms.\n\n## \n  \n  \n  References\n\n*[Read the full report for CVE-2026-116691 on our website](https://cvereports.com/reports/CVE-2026-116691) for more details including interactive diagrams and full exploit analysis.*", "url": "https://wpnews.pro/news/cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in", "canonical_source": "https://dev.to/cverports/cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in-mlflow-crewai-2m4b", "published_at": "2026-10-27 23:30:51+00:00", "updated_at": "2026-10-27 23:41:24.079408+00:00", "lang": "en", "topics": ["ai-safety", "mlops", "ai-agents", "developer-tools", "artificial-intelligence"], "entities": ["MLflow", "CrewAI", "OpenTelemetry", "CVE-2026-116691", "GHSA-j7qq-vr8c-xvw3", "CISA"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in", "markdown": "https://wpnews.pro/news/cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in.md", "text": "https://wpnews.pro/news/cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in.txt", "jsonld": "https://wpnews.pro/news/cve-2026-116691-cve-2026-116691-cleartext-llm-provider-api-key-disclosure-in.jsonld"}}