CVE-2026-116691

MLflow CrewAI autologging can copy provider keys into trace telemetry

MLflow · CrewAI autologging integration

First documented disclosure · Review checkpoint

Summary

Automatic tracing can disclose an application’s LLM provider credentials to trace readers.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Serialization of nested CrewAI Agent and Crew objects records credential-bearing values in span attributes and inputs.

Conditions required

CrewAI autologging enabled with credential-bearing objects; an attacker can read the MLflow trace store or configured OTLP destination.

Potential impact

Provider keys may be exposed beyond their application boundary and used for unauthorized API activity.

Affected versions and configurations

MLflow >=2.19.0, <3.17.0.

Fix and mitigation status

3.17.0 stops new leakage; existing traces require separate handling.

Practical next steps

Upgrade, rotate potentially exposed provider keys, and delete or redact affected traces at every export destination. Disable CrewAI autologging if patching must wait.

Operating lesson

Observability pipelines need their own secret-minimization controls.

Evidence and limits

The public fix PR began September 14, advisory October 13 and CVE October 27. The disclosed reproduction used fake credentials; no real customer theft was established. The fix covers nested span inputs as well as attributes.

Sources