CVE-2026-116691
Description
A flaw was found in MLflow. This vulnerability can lead to sensitive information disclosure when using the CrewAI autologging integration, which serializes agent objects into trace telemetry without sanitizing credential fields. Consequently, plaintext application programming interface (API) keys for Large Language Model (LLM) providers are stored in trace spans. An attacker or unauthorized user with read access to the trace backend or export destination can obtain these credentials and gain unauthorized access to external provider accounts.
Statement
This vulnerability is rated Moderate rather than Important because credential exposure is restricted to environments where CrewAI instrumentation is explicitly invoked and requires preexisting read access to the telemetry backend or export pipeline. In Red Hat OpenShift AI deployments, MLflow autologging for CrewAI is not enabled by default and must be explicitly configured within user workloads. Exploitation does not lead to direct system compromise or code execution, but can permit users with trace viewing privileges to access external provider credentials stored in telemetry metadata.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
