MLflow up to 3.16.x CrewAI Autolog mlflow/crewai/autolog.py mlflow.crewai.autolog missing encryption

Summaryinfo

A vulnerability classified as problematic was found in MLflow up to 3.16.x. Affected by this issue is the function mlflow.crewai.autolog of the file mlflow/crewai/autolog.py of the component CrewAI Autolog. The manipulation results in missing encryption. This vulnerability is known as CVE-2026-116691. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in MLflow up to 3.16.x. It has been classified as problematic. Affected is the function mlflow.crewai.autolog of the file mlflow/crewai/autolog.py of the component CrewAI Autolog. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. CVE summarizes:

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-116691 since 10/26/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 3.17.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• MLflow

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16

Website

• Product: https://github.com/mlflow/mlflow/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion