CVE-2026-116691: CVE-2026-116691: Cleartext LLM Provider API Key Disclosure in MLflow CrewAI Autologging

MLflow versions 2.19.0 through 3.16.x leak plaintext LLM provider API keys into OpenTelemetry trace spans and MLflow tracking stores when CrewAI autologging is enabled, according to CVE-2026-116691 (GHSA-j7qq-vr8c-xvw3), rated CVSS 6.5. The flaw, CWE-532, stems from mlflow.crewai.autolog() failing to sanitize nested CrewAI LLM objects before serialization; a proof-of-concept is publicly available. MLflow 3.17.0 patches the issue with recursive credential sanitization and LLM object summarization, and users are advised to upgrade and rotate exposed keys.

CVE-2026-116691: Cleartext LLM Provider API Key Disclosure in MLflow CrewAI Autologging Vulnerability ID: CVE-2026-116691 CVSS Score: 6.5 Published: 2026-10-27 CVE-2026-116691 GHSA-j7qq-vr8c-xvw3 is a sensitive credential disclosure vulnerability in the MLflow platform affecting versions 2.19.0 through 3.16.x. When CrewAI autologging is enabled via mlflow.crewai.autolog , the tracing instrumentation fails to sanitize nested CrewAI LLM objects before serializing them into OpenTelemetry trace spans. Consequently, plaintext LLM provider API keys are extracted from object dictionaries and string representations, then transmitted and stored in MLflow tracking servers or external OpenTelemetry Protocol OTLP telemetry backends. TL;DR MLflow versions 2.19.0 to 3.16.x leak plaintext LLM API keys into OpenTelemetry trace attributes and span inputs when mlflow.crewai.autolog is used with CrewAI agents configured with explicit API keys. Users should upgrade to MLflow 3.17.0 and rotate affected credentials. ⚠️ Exploit Status: POC Technical Details - CVE / Advisory ID : CVE-2026-116691 / GHSA-j7qq-vr8c-xvw3 - Primary CWE : CWE-532 Insertion of Sensitive Information into Log File - CVSS v3.1 Score : 6.5 Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Attack Vector : Network Telemetry / Trace Backend Retrieval - Affected Component : mlflow.crewai.autolog mlflow/crewai/autolog.py - Affected Versions : = 2.19.0, < 3.17.0 - Patched Version : 3.17.0 - Exploit Status : Proof-of-Concept Publicly Available; Not in CISA KEV Affected Systems - MLflow PyPI package: mlflow versions = 2.19.0, < 3.17.0 using mlflow.crewai.autolog - mlflow : = 2.19.0, < 3.17.0 Fixed in: 3.17.0 Code Analysis Sanitize CrewAI span attributes, inputs, and outputs to strip LLM credentials and sensitive keys 25845 Exploit Details - GitHub Security Advisory https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3 : Official advisory containing both an in-memory serialization reproduction script and an end-to-end OpenTelemetry OTLP trace capture proof-of-concept. Mitigation Strategies - Upgrade MLflow to version 3.17.0 or later to enforce recursive credential sanitization and LLM object summarization during span creation. - Disable CrewAI autologging via mlflow.crewai.autolog disable=True if an immediate package upgrade cannot be performed. - Configure LLM provider credentials via environment variables e.g., OPENAI API KEY rather than passing explicit api key strings to CrewAI LLM constructors. - Audit historical OpenTelemetry trace spans and MLflow tracking stores for exposed credentials, purge affected records, and rotate all compromised LLM API keys. Remediation Steps: 1. Run pip install --upgrade "mlflow =3.17.0" across all Python environments, containers, and CI/CD pipelines utilizing MLflow and CrewAI. 2. Verify the installation by running an in-memory attribute check against mlflow.crewai.autolog. get agent attributes to confirm api key strings are omitted. 3. Search MLflow tracking databases, artifact stores, and downstream OTLP observability backends for regex patterns matching api key='...' or sk-proj-... within attributes.llm , attributes.function calling llm , attributes.agent executor , and attributes.mlflow.spanInputs . 4. Revoke and regenerate all LLM provider API keys identified in historical traces or used in environments where mlflow.crewai.autolog was active on versions 2.19.0 through 3.16.x. 5. Delete or redact historical trace spans containing cleartext secrets from the MLflow backend and third-party telemetry platforms. References Read the full report for CVE-2026-116691 on our website https://cvereports.com/reports/CVE-2026-116691 for more details including interactive diagrams and full exploit analysis.