AI Threat AlertMLflow's CrewAI autologging integration (mlflow.crewai.autolog()) serializes the Agent's llm field, including the provider API key, into trace span inputs, so plaintext LLM credentials are sent to the MLflow tracking backend or any configured OTLP destination. Anyone with read access to traces can harvest those keys, and the CVSS of 6.5 (network, low privileges, high confidentiality impact) understates the downstream exposure because a stolen key gives direct spend and data access at the LLM provider. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so the risk is exposure through misconfiguration, not active exploitation, and the downstream dependent count is unknown. Upgrade MLflow to 3.17.0 or later, rotate every LLM provider key used by CrewAI agents traced since autolog was enabled on 2.19.0 or later, and purge or restrict access to existing traces.
What is the risk?
Medium overall (CVSS 6.5). Exploitation is trivial for anyone with trace read access: no user interaction, low privileges, and no special tooling beyond viewing span inputs. Impact is confined to confidentiality, but the leaked asset is a high-value credential. Risk rises sharply in shared MLflow servers, multi-tenant tracking setups, and where traces are forwarded via OTLP to third-party observability platforms with broader audiences. No known active exploitation, EPSS is unavailable, and no public exploit exists, so likelihood depends on internal access controls and trace retention.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade MLflow to 3.17.0 or later. 2) Rotate all LLM provider API keys used by CrewAI agents while mlflow.crewai.autolog() was active, since traces may contain them. 3) Search the tracking store and OTLP backends for key patterns (for example sk-, provider key prefixes) in span inputs and delete or redact affected traces, including backups. 4) Until patched, disable mlflow.crewai.autolog() or pass credentials via environment variables or a secrets manager rather than in the LLM object, and consider a span processor that redacts sensitive fields. 5) Restrict trace read access with least privilege and review who accessed the MLflow UI/API and OTLP backends. 6) Add secret-scanning to trace pipelines and monitor provider dashboards for anomalous usage or unfamiliar source IPs.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-116691?
MLflow's CrewAI autologging integration (mlflow.crewai.autolog()) serializes the Agent's llm field, including the provider API key, into trace span inputs, so plaintext LLM credentials are sent to the MLflow tracking backend or any configured OTLP destination. Anyone with read access to traces can harvest those keys, and the CVSS of 6.5 (network, low privileges, high confidentiality impact) understates the downstream exposure because a stolen key gives direct spend and data access at the LLM provider. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so the risk is exposure through misconfiguration, not active exploitation, and the downstream dependent count is unknown. Upgrade MLflow to 3.17.0 or later, rotate every LLM provider key used by CrewAI agents traced since autolog was enabled on 2.19.0 or later, and purge or restrict access to existing traces.
Is CVE-2026-116691 actively exploited?
No confirmed active exploitation of CVE-2026-116691 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-116691?
1) Upgrade MLflow to 3.17.0 or later. 2) Rotate all LLM provider API keys used by CrewAI agents while mlflow.crewai.autolog() was active, since traces may contain them. 3) Search the tracking store and OTLP backends for key patterns (for example sk-, provider key prefixes) in span inputs and delete or redact affected traces, including backups. 4) Until patched, disable mlflow.crewai.autolog() or pass credentials via environment variables or a secrets manager rather than in the LLM object, and consider a span processor that redacts sensitive fields. 5) Restrict trace read access with least privilege and review who accessed the MLflow UI/API and OTLP backends. 6) Add secret-scanning to trace pipelines and monitor provider dashboards for anomalous usage or unfamiliar source IPs.
What systems are affected by CVE-2026-116691?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration (CrewAI), MLOps experiment tracking and tracing, LLM observability pipelines, OTLP trace export backends.
What is the CVSS score for CVE-2026-116691?
CVE-2026-116691 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.21%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0055Unsecured CredentialsAML.T0083Credentials from AI Agent ConfigurationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.
Exploitation Scenario
An internal user or contractor with read-only access to a shared MLflow tracking server, or an attacker who has obtained low-privilege MLflow credentials, opens traces generated by a CrewAI application with autolog enabled. They inspect the span inputs for the Agent object and copy the plaintext LLM provider API key. The attacker then uses the key to run inference at the victim's expense, access provider-side resources tied to the key, or resell it, all without touching the production application. The same leak applies if traces are exported through OTLP to a third-party observability vendor whose staff or compromised accounts can read them.
Weaknesses (CWE)
CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimaryCWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimaryCWE-312Cleartext Storage of Sensitive InformationPrimaryCWE-312Cleartext Storage of Sensitive InformationPrimaryCWE-532Insertion of Sensitive Information into Log FilePrimaryCWE-532Insertion of Sensitive Information into Log FilePrimaryCWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-312Cleartext Storage of Sensitive InformationCWE-532Insertion of Sensitive Information into Log FileCWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2025-1537910.0MLflow: RCE via unsanitized model dependency specs
Same package: mlflowCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same package: mlflowCVE-2023-27809.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2026-26359.8mlflow: security flaw enables exploitation
Same package: mlflowCVE-2023-11779.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflow