MLflow CrewAI autologging records LLM provider API keys in logged trace spans
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.17.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MLflow's CrewAI autologging integration (mlflow.crewai.autolog()) is affected, and it can store plaintext LLM provider API keys inside logged trace data. Anyone who can read those traces, or the configured trace destination, could obtain those credentials.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- mlflow mlflow
From 2.19.0 · fixed in 3.17.0
- mlflowPyPI
From 2.19.0 · fixed in 3.17.0