GHSA-J7QQ-VR8C-XVW3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

CVE-2026-116691

The MLflow AI engineering platform is vulnerable in versions 2.19.0 through 3.17.0 due to insufficient sanitization of nested credentials during autologging. Specifically, the mlflow.crewai.autolog() function fails to scrub credential-bearing values when recording CrewAI Agent objects. The functi...

CVE-2026-116691 MLflow CrewAI autologging records LLM provider API keys in logged trace spans

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog records CrewAI Agent objects without consistently sanitizing nested credential-bearing values...