MLflow's CrewAI autologging feature in versions >=2.19.0 and <3.17.0 leaks CrewAI LLM provider API keys in trace telemetry. The vulnerability arises because MLflow serializes the CrewAI Agent object's __dict__ including the LLM object, whose string representation contains the API key in plaintext. This sensitive information is unintentionally sent to MLflow's trace backend or any configured OTLP destination without explicit logging by the application. The issue affects MLflow 3.16.0 with CrewAI 1.15.18 and is fixed in MLflow 3.17.0.