{"slug": "i-found-an-api-key-leak-in-mlflow-and-why-your-ai-agent-may-have-one-too", "title": "I found an API key leak in MLflow, and why your AI agent may have one too", "summary": "MLflow, the open-source AI agent tracing platform, leaked LLM provider API keys into its tracking backend and any OTLP export destinations when CrewAI autologging was enabled, affecting versions 2.19.0 through 3.16.x; the flaw is tracked as CVE-2026-116691 and was fixed in MLflow 3.17.0 via PR #25845. The researcher, building an open-source key-leak scanner called Weir at company Ralis, reported the issue and MLflow credited the report; the advisory directs users to upgrade to mlflow>=3.17.0, rotate any LLM provider key held by a CrewAI LLM object while mlflow.crewai.autolog() was on, and delete or redact affected traces in the tracking backend and any OTLP destination. Users who cannot upgrade can set mlflow.crewai.autolog(disable=True) as a workaround, since upgrading stops new leakage but does not remove keys already written.", "body_md": "An API key should go to one place: the service it belongs to. In MLflow, it also went somewhere else.\n\nMLflow is a widely used open-source platform that, among other things, records what an AI agent does, step by step, so you can debug it later. These records are called traces. With CrewAI autologging turned on (`mlflow.crewai.autolog()`), MLflow's record of the agent included the LLM provider's API key: the key the agent uses to call OpenAI, Anthropic or another model provider.\n\nThe app never logged the key. The instrumentation did. So the key sat in the MLflow tracking backend, and in any other system those traces were exported to.\n\nI reported it, and MLflow credited the report. It is now CVE-2026-116691.\n\n- Advisory: [https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3](https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3)\n- NVD: [https://nvd.nist.gov/vuln/detail/cve-2026-116691](https://nvd.nist.gov/vuln/detail/cve-2026-116691)\n- Affected: MLflow from 2.19.0. Fixed: MLflow shipped a fix in 3.17.0 (PR #25845).\n\nFrom the advisory's remediation section:\n\n1. Upgrade to `mlflow>=3.17.0` .\n2. Rotate any LLM provider key that a CrewAI `LLM` object held while`mlflow.crewai.autolog()` was on, on MLflow 2.19.0 through 3.16.x. Upgrading stops new leakage but does not remove keys already written.\n3. Delete or redact the affected traces in the MLflow tracking backend and in any OTLP destination they were exported to.\n\nIf you cannot upgrade yet, the advisory's workaround is `mlflow.crewai.autolog(disable=True)`.\n\nI found it with Weir, the open-source tool I'm building around one rule: a key goes to its own service and nowhere else.\n\nTo see what a leak report looks like:\n\n```\npip install weir-scan\nweir canary judge --sample\n```\n\nTo test your own agent:\n\n```\npip install weir-scan weir-run\nweir-run run --config canary.toml\n```\n\nweir-run plants fake keys, runs your agent's own flows against a local fake model, and looks for those exact values, raw or encoded, in its telemetry, console output, model requests and other outbound requests. You get leak, clean or incomplete, and it shows which planted keys reached an export. A GitHub Action fails the pull request job on a leak or an incomplete run.\n\nWhat it does not do: it covers only the paths the run exercised, and it misses hashed, split or truncated keys. No AI model decides a verdict, and the CLI itself sends nothing anywhere.\n\nThe tools are free and Apache-2.0: [https://github.com/ralis-ai/weir](https://github.com/ralis-ai/weir)\n\nRalis, the company behind Weir, is looking for design partners: teams running AI agents on AWS. We run the test in your CI, as a free two-week pilot, and nothing leaves your environment. If that's you, get in touch through the repo.\n\nBuilt with AI assistance; I reproduced the MLflow leak before reporting it.", "url": "https://wpnews.pro/news/i-found-an-api-key-leak-in-mlflow-and-why-your-ai-agent-may-have-one-too", "canonical_source": "https://github.com/ralis-ai/weir/blob/main/docs/cve-2026-116691.md", "published_at": "2026-11-11 17:33:57+00:00", "updated_at": "2026-11-11 17:51:11.273303+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "mlops", "developer-tools"], "entities": ["MLflow", "CrewAI", "CVE-2026-116691", "Weir", "Ralis", "OpenAI", "Anthropic", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-found-an-api-key-leak-in-mlflow-and-why-your-ai-agent-may-have-one-too", "markdown": "https://wpnews.pro/news/i-found-an-api-key-leak-in-mlflow-and-why-your-ai-agent-may-have-one-too.md", "text": "https://wpnews.pro/news/i-found-an-api-key-leak-in-mlflow-and-why-your-ai-agent-may-have-one-too.txt", "jsonld": "https://wpnews.pro/news/i-found-an-api-key-leak-in-mlflow-and-why-your-ai-agent-may-have-one-too.jsonld"}}