[sylvesterkaczmarek]

Summary

Add the two independently installable PyPI distributions that also ship the affected CrewAI instrumentation:

• mlflow-skinny: >= 2.19.0, < 3.17.0
• mlflow-tracing: < 3.17.0

The advisory currently maps only mlflow. Neither of the added distributions requires the full mlflow distribution, so installations using them alone are missing from this advisory's package mapping.

Evidence

I compared the published PyPI wheels, verifying each download against its PyPI SHA-256 digest. The complete mlflow/crewai/autolog.py file is byte-identical across mlflow, mlflow-skinny and mlflow-tracing at both 3.16.1 and 3.17.0:

Version	Module SHA-256
3.16.1	ec7ddd0dee56580f4767cbc347538adc981c785e668f08f5d284fcdf89a4784f
3.17.0	d0fe31073a47ee3ab845ce8cb6d5771de2b57db3add432d2288d0997b274bcf0

The 3.17.0 module contains the credential sanitization from the already-referenced upstream fix, mlflow/mlflow#25845.

Boundary checks:

• mlflow-skinny 2.18.0 has no CrewAI instrumentation; 2.19.0 ships the same affected module as mlflow 2.19.0. This preserves the existing advisory's introduction boundary.
• The first published mlflow-tracing wheel, 3.0.0.0rc1, already contains the affected instrumentation. I also checked 3.0.0rc1.post1, 3.0.0, 3.1.0 and 3.1.3. The new range therefore starts at 0 to cover this distribution from its initial release.
• Thirteen bounded source-level checks executed the original wheel function bodies with a synthetic credential-bearing LLM test double: the affected versions retained the synthetic key, while 3.17.0 removed it. These were isolated function tests, not an end-to-end CrewAI/OTLP reproduction.

Published release artifacts:

• https://pypi.org/project/mlflow-skinny/2.19.0/
• https://pypi.org/project/mlflow-skinny/3.16.1/
• https://pypi.org/project/mlflow-skinny/3.17.0/
• https://pypi.org/project/mlflow-tracing/3.0.0.0rc1/
• https://pypi.org/project/mlflow-tracing/3.16.1/
• https://pypi.org/project/mlflow-tracing/3.17.0/

Only package mappings and supporting references change. The original mlflow range, description, severity and existing attribution remain unchanged. This is a correction to an already-public advisory, not a new vulnerability report.

AI assistance was used for artifact inspection, test scripting and drafting. The stated checks were executed locally; no live service or real credential was used.