MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Summary mlflow.crewai.autolog() leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representation includes its apikey in plaintext. As a result, an application that calls mlflow.crewai.autolog() can unintentionally send its LLM provider API key to the MLflow trace backend or configured OTLP destination. The application does not need to explicitly log the credential or place it in a span attribute. The credential is extracted automatically by MLflow's instrumentation. This was verified on MLflow 3.16.0 with CrewAI 1.15.18 using MLflow's own OTLP exporter. The fake credential appeared in 5 attribute locations across 2 spans. Details The primary issue is in: mlflow/crewai/autolog.py::getagentattributes() The function walks the CrewAI Agent.dict and converts agent fields to strings. tools and embedder receive special handling, but credential-bearing objects such as the following are not sanitized: llm functioncallingllm agentexecutor crew For example, agent.llm is a CrewAI LLM object.…

curl https://cve.zerocrew.in/api/cve/CVE-2026-116691