MLflow fixes CrewAI autologging vulnerability that leaked API keys
Understand this story
MLflow has fixed a vulnerability: when mlflow.crewai.autolog() is enabled, CrewAI's LLM provider API keys are written into traces. The vulnerability is tracked as CVE-2026-116691, affects MLflow 2.19.0 through 3.16.x, and was fixed in version 3.17.0 via PR #25845. Upgrading to mlflow>=3.17.0 only prevents new leaks; it does not purge keys already written. Therefore, users who enabled this autologging on affected versions need to rotate the LLM provider keys held by the CrewAI LLM objects at that time. If upgrading is not immediately possible, the advisory's workaround is to call mlflow.crewai.autolog(disable=True). The author who discovered the vulnerability has also open-sourced a detection tool called Weir.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AII found an API key leak in MLflow, and why your AI agent may have one too
The author reports that MLflow's CrewAI autologging (mlflow.crewai.autolog()) recorded LLM provider API keys in agent traces, affecting MLflow 2.19.0 through 3.16.x; the issue is tracked as CVE-2026-116691 and fixed in MLflow 3.17.0 (PR #25845). The advisory recommends upgrading to mlflow>=3.17.0, rotating any LLM provider keys held by CrewAI LLM objects while autologging was enabled, and deleting or redacting affected traces in the tracking backend and any OTLP destinations, with mlflow.crewai.autolog(disable=True) as a workaround. The author also describes Weir, an open-source Apache-2.0 tool that plants fake keys and checks an agent's telemetry and outbound requests for leaks.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 12 02:00
- Change in the past 24 hours
- -51%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.