중간취약점
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
GHSA-j7qq-vr8c-xvw3 · CVE-2026-116691 · 갱신 2026. 10. 28.
영향 받는 패키지
| 생태계 | 패키지 | 수정 버전 |
|---|---|---|
| PyPI | mlflow | 3.17.0 |
GHSA-j7qq-vr8c-xvw3 · CVE-2026-116691 · 갱신 2026. 10. 28.
| 생태계 | 패키지 | 수정 버전 |
|---|---|---|
| PyPI | mlflow | 3.17.0 |
MLflow subsequently stores this string as a span attribute.
There is an important indication that this is an unintended disclosure: MLflow's dedicated LLM attribute extraction already explicitly excludes api_key in _get_llm_attributes(). The LLM span therefore does not expose the credential, while the broader Agent __dict__ serialization bypasses that protection.
There is also a second, independent serialization path in:
mlflow/crewai/autolog.py::_construct_full_inputs()
This code uses:
v.__dict__ if hasattr(v, "__dict__") else v
on call arguments. During CrewAI execution, the Agent object is passed as an argument, causing its __dict__ to be expanded and the credential-bearing LLM object to be included in mlflow.spanInputs.
Therefore, there are two independent leakage paths:
_get_agent_attributes()_construct_full_inputs()Fixing only the Agent attribute serialization would leave the mlflow.spanInputs path vulnerable.
A safer approach would be to avoid recursively serializing arbitrary object __dict__ values. Agent telemetry should use an explicit allowlist of non-sensitive scalar fields, and credential-bearing objects such as llm, function_calling_llm, agent_executor, and crew should either be reduced to safe metadata or omitted.
Similarly, _construct_full_inputs() should not automatically expand arbitrary objects through __dict__, or the resulting values should pass through the same sanitization mechanism before being attached to a span.
Environment:
MLflow: 3.16.0
CrewAI: 1.15.18
Python: 3.12.3
opentelemetry-exporter-otlp-proto-http: 1.42.1
The following demonstrates the vulnerability without starting a Crew, making a network request, or requiring an MLflow server:
import importlib
from crewai import LLM, Agent
autolog = importlib.import_module("mlflow.crewai.autolog")
llm = LLM(
model="gpt-4.1-mini",
api_key="sk-proj-EXAMPLE1234567890",
)
agent = Agent(
role="r",
goal="g",
backstory="b",
llm=llm,
)
attrs = autolog._get_agent_attributes(agent)
assert "sk-proj-EXAMPLE1234567890" in attrs["llm"]
print(attrs["llm"])
The output contains the API key in plaintext, for example:
llm_type='openai' model='gpt-4.1-mini' ... api_key='sk-proj-EXAMPLE1234567890' ...
No provider request is required.
The issue can also be reproduced through MLflow's actual OTLP exporter.
Configure a local OTLP HTTP receiver and set:
export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://127.0.0.1:4318/v1/traces
export OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf
export CREWAI_DISABLE_TELEMETRY=true
Then run:
import mlflow
from crewai import Agent, Crew, LLM, Task
mlflow.crewai.autolog()
llm = LLM(
model="gpt-4.1-mini",
api_key="sk-proj-EXAMPLE1234567890",
)
agent = Agent(
role="Support Responder",
goal="Answer support questions",
backstory="A support agent",
llm=llm,
)
task = Task(
description="Answer the user's question",
expected_output="A response",
agent=agent,
)
crew = Crew(
agents=[agent],
tasks=[task],
)
crew.kickoff()
A local OTLP receiver can decode the ExportTraceServiceRequest sent by MLflow.
The provider request is expected to fail because the credential is intentionally fake. This does not affect the vulnerability: the sensitive value is added to the MLflow span when the instrumentation starts, before the provider call succeeds or fails.
In the tested environment, the fake API key appeared in the exported telemetry in 5 locations across 2 spans, including:
Support Responder
attributes.llm
attributes.function_calling_llm
attributes.agent_executor
attributes.mlflow.spanInputs
Task.execute_sync
attributes.mlflow.spanInputs
The captured value is produced by MLflow's actual telemetry/export path rather than being manually inserted into a span.
All credentials used in the reproduction are locally generated fake values. No real API credential is required.
Type: Sensitive Information Disclosure / Credential Disclosure CWE: CWE-532 — Insertion of Sensitive Information into Log File
Any application using mlflow.crewai.autolog() with a CrewAI LLM configured with an API key can unintentionally disclose that credential through MLflow traces.
The credential is written to trace telemetry even though the application does not explicitly log it.
Anyone with access to the MLflow trace storage or configured OTLP destination may therefore obtain the provider credential. Depending on the deployment, this can include MLflow users, observability operators, or third-party telemetry providers.
The leaked credential can then potentially be used against the corresponding LLM provider account, including for unauthorized API usage and associated costs.
The issue is particularly significant because the credential crosses a trust boundary: a provider API key intended for use by the application is automatically copied into observability telemetry where a broader set of users or systems may have access.
The vulnerability does not require the developer to intentionally log the secret. The only relevant prerequisite is enabling the CrewAI autologging integration.
Fixed in MLflow 3.17.0 by #25845. mlflow.crewai.autolog() now reduces CrewAI LLM objects to their model name and drops credential-like keys before they are written to span attributes or mlflow.spanInputs.
mlflow>=3.17.0.LLM object held (for example one passed as LLM(api_key=...)) while mlflow.crewai.autolog() was enabled on MLflow 2.19.0 through 3.16.x.mlflow.spanInputs.If you cannot upgrade yet, disable CrewAI autologging with mlflow.crewai.autolog(disable=True).