Most recent entries from all

fkie_cve-2026-116691

2026-11-02T08:39:33.905900+00:00

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

GHSA-j7qq-vr8c-xvw3 — MLflow CrewAI autologging records LLM provider API keys in logged trace spans

2026-11-02T08:39:33.905982+00:00

Affected: PyPI: mlflow

### Summary

`mlflow.crewai.autolog()` leaks CrewAI LLM provider API keys into MLflow trace telemetry.

When a CrewAI `Agent` is instrumented with MLflow autologging, MLflow serializes the agent's `__dict__` and converts its fields to strings. The `llm` field contains the CrewAI LLM object, whose string representation includes its `api_key` in plaintext.

As a result, an application that calls `mlflow.crewai.autolog()` can unintentionally send its LLM provider API key to the MLflow trace backend or configured OTLP destination.

The application does not need to explicitly log the credential or place it in a span attribute. The credential is extracted automatically by MLflow's instrumentation.

This was verified on **MLflow 3.16.0** with **CrewAI 1.15.18** using MLflow's own OTLP exporter. The fake credential appeared in **5 attribute locations across 2 spans**.

### Details

The primary issue is in:

`mlflow/crewai/autolog.py::_get_agent_attributes()`

The function walks the CrewAI `Agent.__dict__` and converts agent fields to strings. `tools` and `embedder` receive special handling, but credential-bearing objects such as the following are not sanitized:

* `llm` * `function_calling_llm` * `agent_executor` * `crew`

For example, `agent.llm` is a CrewAI `LLM` object. In CrewAI 1.15.18, the underlying LLM model contains `api_key` as a normal field. Its string representation therefore contains the credential:

```text llm_type='openai' model='gpt-4.1-mini' ... api_key='sk-proj-.…

WID-SEC-W-2026-3875 — MLflow: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

2026-11-02T08:39:33.906116+00:00

Ein Angreifer kann mehrere Schwachstellen in MLflow ausnutzen, um Informationen offenzulegen.