CVE-2026-58449: txtai API Endpoint RCE Vulnerability

CVE-2026-58449 Overview

CVE-2026-58449 is an unsafe reflection vulnerability [CWE-94] in txtai through version 9.10.0. The txtai API /reindex endpoint resolves its function body parameter through txtai.util.Resolver, which calls __import__ and getattr on the caller-supplied dotted path without any allowlist. When the API is deployed with no TOKEN configured and the index is writable, an unauthenticated remote attacker can set function to an arbitrary callable such as subprocess.getoutput, achieving remote code execution as the server process. The issue is fixed in commit 11b32da, which gates the endpoint behind a new reindex configuration flag.

Critical Impact
Unauthenticated attackers can execute arbitrary operating system commands as the txtai server process when the API is exposed without a token and the index is writable.

Affected Products

neuml txtai versions through 9.10.0
txtai deployments exposing the API with no TOKEN set
txtai deployments configured with a writable index

Discovery Timeline

2026-06-30 - CVE-2026-58449 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58449

Vulnerability Analysis

The vulnerability resides in the API /reindex endpoint implemented in src/python/txtai/api/routers/embeddings.py. The endpoint accepts a function parameter in the request body, which is passed to txtai.util.Resolver. The resolver treats the value as a dotted Python path and invokes __import__ followed by getattr to load the referenced callable. No allowlist, denylist, or type check restricts which modules or attributes can be resolved.

Because authentication in txtai is opt-in, deployments that omit the TOKEN environment variable expose every API route without credentials. When such a deployment also runs with a writable index, /reindex becomes reachable and executes attacker-controlled callables during the reindex operation.

Root Cause

The root cause is unsafe reflection over untrusted input. Resolver imports any module the caller names and returns any attribute the caller requests, so callables such as subprocess.getoutput, os.system, or builtins.eval can be selected as the reindex function. This pattern maps to [CWE-94] Improper Control of Generation of Code.

Attack Vector

An attacker sends an HTTP request to the /reindex endpoint of an internet-exposed txtai instance. The function field in the JSON body is set to a fully qualified Python path such as subprocess.getoutput, and additional parameters supply the command string. During reindex processing, txtai imports the module, resolves the callable, and invokes it with attacker-supplied arguments, producing command execution as the server user.

python

# Patch excerpt: src/python/txtai/api/routers/embeddings.py
 from ..responses import ResponseFactory
 from ..route import EncodingAPIRoute

-from ...app import ReadOnlyError
+from ...app import ReadOnlyError, ReindexDisabledError
 from ...graph import Graph

 router = APIRouter(route_class=EncodingAPIRoute)

Source: GitHub commit 11b32da. The fix introduces a ReindexDisabledError and requires operators to explicitly enable reindex through configuration before the endpoint accepts requests.

Detection Methods for CVE-2026-58449

Indicators of Compromise

HTTP POST requests to the /reindex path containing a function field whose value references sensitive modules such as subprocess, os, builtins, pty, or socket.
Child processes spawned by the txtai Python interpreter that execute shells, curl, wget, or reverse-shell payloads.
Outbound network connections initiated by the txtai process to previously unseen destinations shortly after /reindex requests.
Unexpected writes to the txtai index directory correlated with anomalous API activity.

Detection Strategies

Inspect reverse proxy and application logs for requests to /reindex and alert on any function value outside an approved list.
Correlate API requests with process creation events on the host running txtai to catch shell or interpreter invocations parented by the Python process.
Monitor for outbound connections from the txtai service account, especially to non-corporate IP ranges.

Monitoring Recommendations

Enable verbose access logging on the txtai HTTP layer and forward logs to a centralized analytics platform for retention and search.
Track version and configuration drift on txtai hosts to identify instances still running <= 9.10.0 or lacking the reindex configuration flag.
Baseline normal API consumers of /reindex and alert on new source addresses invoking the endpoint.

How to Mitigate CVE-2026-58449

Immediate Actions Required

Upgrade txtai to the version containing commit 11b32da or later, which introduces the reindex configuration gate.
Set a strong TOKEN environment variable so all API endpoints require authentication.
Restrict network exposure of the txtai API to trusted internal networks or place it behind an authenticating reverse proxy.
Audit existing deployments for the combination of no TOKEN and a writable index, and disable the API on any host that does not require it.

Patch Information

The fix is committed in neuml/txtai commit 11b32da, tracked in GitHub issue #1111 and issue #1122. Technical details are described in the VulnCheck advisory. The patch adds a ReindexDisabledError and requires operators to explicitly enable reindex through configuration.

Workarounds

Configure the index as read-only so /reindex cannot mutate state and the vulnerable code path is not reached.
Require an API TOKEN and enforce authenticated access to every endpoint.
Block the /reindex route at the reverse proxy or API gateway for deployments that do not need reindexing at runtime.
Run the txtai process under a dedicated low-privilege user account with restricted filesystem and network access to limit blast radius if the endpoint is reached.

bash

# Example: require token authentication and mark the index read-only
export TOKEN="$(openssl rand -hex 32)"
cat > config.yml <<'EOF'
writable: false
embeddings:
  path: /var/lib/txtai/index
EOF
# Restart the txtai API with the hardened configuration
txtai config.yml