Evidence · DiggingBeagle record
MLflow CrewAI autolog credential tracing, GHSA-j7qq-vr8c-xvw3
Maintainer reproduction of provider API-key material serialized into OTLP trace attributes.
- Source role
- primary disclosure
Evidence record
Maintainer reproduction of provider API-key material serialized into OTLP trace attributes.
Claim-level citations (2)
- supportsMLflow CrewAI autologging could copy provider keys into tracing spans: The MLflow advisory reproduces provider credential strings in multiple OTLP attributes from CrewAI agent instrumentation and identifies 3.17.0 as the fixed release.
GHSA-j7qq-vr8c-xvw3: _get_agent_attributes, _construct_full_inputs and proof of concept
- supportsMLflow CrewAI autologging could copy provider keys into tracing spans: The MLflow CrewAI instrumentation serialized agent configuration objects and model attributes without reliably removing provider credentials. Affected applications must use the CrewAI tracing integration and expose its resulting OTLP attributes to a trace viewer or telemetry collector. The published reproduction placed a synthetic API key in several attributes across two spans; trace visibility could disclose equivalent real secrets.
GHSA-j7qq-vr8c-xvw3: _get_agent_attributes, _construct_full_inputs and proof of concept