CVE-2026-116691: MLflow credential leak in CrewAI autolog

CVE-2026-116691 · Severity: medium · CVSS 6.5 · Published 2026-10-27

MLflow is an open-source platform for managing machine learning and AI workflows, including integration with CrewAI agents. The mlflow.crewai.autolog() function was recording API credentials (such as OpenAI keys) in plaintext within trace telemetry sent to MLflow backends or external OTLP systems, where any trace reader could obtain them. An attacker or unauthorized user with access to MLflow traces could extract provider API keys and use them to make unauthorized API calls or access external AI services.

Technologies: Mlflow, mlflow (PyPI). Vendors: MLflow, PyPI.

Quick answers

Is CVE-2026-116691 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116691 being exploited in the wild.
How severe is CVE-2026-116691?
Medium severity, with a CVSS score of 6.5, published 27 October 2026.
Which products and versions are affected?
Mlflow 2.19.0 to 3.16.0; mlflow (PyPI) >= 2.19.0, < 3.17.0, ECOSYSTEM:introduced=2.19.0,fixed=3.17.0.
Is there a fix for CVE-2026-116691?
Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116691 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-116691?
Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.17.0 or later
    pip install "mlflow>=3.17.0"

Technical details

The vulnerability exists in mlflow/crewai/autolog.py where CrewAI Agent, Crew, and Task objects are serialized to span attributes and inputs without sanitizing credential-bearing fields. The _get_agent_attributes() and _construct_full_inputs() functions convert LLM provider objects (which include api_key fields) to strings and nested dictionaries, exposing credentials in three paths: Agent span attributes, span inputs via _construct_full_inputs(), and Crew span attributes. The fix (version 3.17.0) implements recursive credential sanitization that strips api_key, apiKey, secret, password, and token fields from pydantic models before trace transmission.

Affected products

  • MLflow MLflow 2.19.0 to 3.16.0

Identifiers

  • CVE-2026-116691
  • GHSA-j7qq-vr8c-xvw3

Timeline

  • 2026-10-27: disclosed
  • 2026-09-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.