CVE-2026-116691 · GHSA-j7qq-vr8c-xvw3
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
- Risk score
- 44/100
- CVSS
- 6.5 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts th…
- Affected
- mlflow (pip) >= 2.19.0, < 3.17.0
- Fix
- Upgrade mlflow to 3.17.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
mlflow: Amber, patch this week. MLflow is vulnerable to remote code execution on unauthenticated servers due to third-party scorer deserialization. An attacker can execute code without credentials, or with basic-auth credentials if they can create an experiment and run and upload artifacts.
The flaws
- CVE-2026-116691: MLflow CrewAI autologging records LLM provider API keys in logged trace spans (CVSS 6.5)
- CVE-2026-116692: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules (CVSS 9.8)
- CVE-2026-53995: MLflow FileStore trace IDs allow path traversal and arbitrary file writes (CVSS 8.2 · EPSS 1%)
- CVE-2026-116690: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source (CVSS 7.5)
The fix
Upgrade mlflow: 3.17.0 or later on your release line
Who is exposed: {'products': ['MLflow'], 'packages': [{'ecosystem': 'pip', 'name': 'mlflow', 'vulnerable': '>= 3.12.0rc0, < 3.17.0'}]}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Information disclosure (CWE-200). 247 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| mlflow | pip | >= 2.19.0, < 3.17.0 | 3.17.0 |
References
- https://github.com/mlflow/mlflow/commit/20927930d27f0072fcfeb7f024f24ad8c5e77c47
- https://github.com/mlflow/mlflow/pull/25845
- https://github.com/mlflow/mlflow/releases/tag/v3.17.0
- https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3
- https://github.com/advisories/GHSA-j7qq-vr8c-xvw3
- https://github.com/advisories/GHSA-j7qq-vr8c-xvw3
Original description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.
Last activity 27 Oct 2026. Patch Forecast updates every hour.