CVE-2026-116691 mlflow CVE debrief

Who should care

Defenders responsible for MLflow and CrewAI configurations, as well as teams monitoring trace telemetry for potential security issues, should assess exposure and prioritize verification of their environments.

Why it matters

Defenders should care about CVE-2026-116691 because it involves the unintentional exposure of CrewAI LLM provider API keys in MLflow trace telemetry. This issue affects teams using MLflow and CrewAI, particularly those responsible for configuring and monitoring these tools. The exposure of sensitive credentials could lead to security breaches if not properly addressed. Verification and sanitization of API keys in autologging setups are crucial to prevent potential security incidents.

• Potential API key leakage into logged trace spans
• Unintentional exposure of sensitive credentials
• Need for verification of MLflow and CrewAI configurations
• Prioritization of API key sanitization in autologging setups

Technical summary

The mlflow.crewai.autolog() function leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's __dict__ and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representation includes its api_key in plaintext. This issue affects teams using MLflow and CrewAI, particularly those responsible for configuring and monitoring these tools. The exposure of sensitive credentials could lead to security breaches if not properly addressed. Verification and sanitization of API keys in autologging setups are crucial to prevent potential security incidents.

Defensive priority

Defenders should prioritize verifying MLflow and CrewAI configurations, reviewing logged trace spans, and sanitizing API keys.

Recommended defensive actions

• Verify MLflow and CrewAI configurations to prevent unintentional API key exposure
• Review logged trace spans for potential API key leakage
• Sanitize API keys in MLflow autologging configurations
• Update to MLflow version 3.17.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue was verified on MLflow 3.16.0 with CrewAI 1.15.18 using MLflow's own OTLP exporter. The fake credential appeared in 5 attribute locations across 2 spans. The verification process involved reviewing the MLflow and CrewAI configurations, as well as the logged trace spans. The source grounding indicates that the issue is related to the autologging feature in MLflow and CrewAI. The evidence limits suggest that the issue may be limited to specific versions of MLflow and CrewAI. Defenders should verify their environments to ensure

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.