MediumVulnerabilityLLM-specific
GHSA-j7qq-vr8c-xvw3: MLflow CrewAI autologging records LLM provider API keys in logged trace spans
- Identifiers
- CVE-2026-116691GHSA-j7qq-vr8c-xvw3
- Published
- Record updated
- Affected
- mlflow >= 2.19.0, < 3.17.0
- Fixed in
- 3.17.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
MLflow's `mlflow.crewai.autolog()` serializes a CrewAI `Agent.__dict__` into span attributes, and the `llm` field's string form includes its `api_key` in plaintext. Applications using autologging can therefore send LLM provider API keys to the MLflow trace backend or configured OTLP destination without explicitly logging them. The issue was verified on MLflow 3.16.0 with CrewAI 1.15.18.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents
Related items
- InfoUK Politician Jess Asato Got Deepfaked. Now She’s Taking xAI to CourtSimilar attack · Wired (Security)
- MediumCVE-2026-116575: Mem0 SDK session scope collision in add() exposes cross-tenant conversationsSimilar attack · NVD/CVE Database
- HighCVE-2026-110474: CreditNirvana Agentic AI Call Centre hardcoded API key in client-side JavaScriptSimilar attack · NVD/CVE Database
- InfoFrom Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation InversionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- LowThe AI notetaker risk is now an everywhere problemSimilar attack · CSO Online