Database/AI/ML frameworks & serving
MLflow: CrewAI autologging writes provider API keys in plaintext into traces
Impact
mlflow.crewai.autolog() stringifies the CrewAI Agent llm field into span attributes and expands the whole Agent object into mlflow.spanInputs without sanitizing nested credential fields, so provider API keys land in plaintext in the MLflow trace backend and in any configured OTLP destination. On a shared fleet the tracking server and the telemetry pipeline are usually readable by a much wider group than the team that owns the key, so every trace reader inherits the credential. Keys already written stay in the backend after upgrading and must be rotated. Affects 2.19.0 up to 3.17.0.
Who can reach it
Any user with read access to the MLflow tracking/trace backend or the OTLP collector that receives the spans. No exploitation step is needed - the credentials are simply recorded.
What to do
Upgrade MLflow to 3.17.0 and restart the tracking server and the client workloads that do the autologging. Rotate any provider API keys used by CrewAI agents while the vulnerable versions were in use, and purge or restrict the existing traces - the fix does not scrub what has already been stored.
References
Related entries
- Kubeflow Pipelines: frontend artifact routes skip namespace authorization, exposing other tenants' artifactsCVE-2026-118760 · Kubeflow Pipelines frontend (artifact routes, namespace authorization)Medium
- vLLM: unbounded frame count in video/jpeg base64 data URLs crashes the server with OOMCVE-2026-34755 · vLLM OpenAI-compatible API server (video/jpeg base64 multimodal path)Medium
- vLLM: no upper bound on the n parameter lets a single request OOM the API serverCVE-2026-34756 · vLLM OpenAI-compatible API server (ChatCompletionRequest/CompletionRequest n parameter)Medium
- vLLM (revision pinning): Revision pinning does not apply to all model artifactsCVE-2026-47155 · vLLM (revision pinning)Medium
- Starlette: malformed Host header makes request.url.path diverge from the routed pathCVE-2026-48710 · Starlette (Host header validation when reconstructing request.url)Medium
- vLLM - sampling parameter validation: Temperature validation uses strict comparison operators, so boundary values slipCVE-2026-54235 · vLLM - sampling parameter validationMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.