Which versions of txtai are affected by CVE-2026-58449?

txtai, a widely-deployed AI indexing platform, contains a critical remote code execution vulnerability affecting versions through 9.10.0 that allows unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-58449?

Within 24 hours: Verify TOKEN authentication is enforced on all txtai API endpoints; restrict network access to the txtai service via firewall rules. Within 7 days: Update txtai to a patched version-consult the vendor security advisory for the specific release addressing CVE-2026-58449. Within 30 days: Conduct organization-wide audit of txtai deployments to identify instances with network exposure, missing authentication tokens, or writable indexes, and remediate non-compliant configurations.

txtai CVE-2026-58449

Q: What is the CVSS score of CVE-2026-58449?

CVE-2026-58449 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-40418 CRITICAL

Code Injection (CWE-94)

2026-06-30 VulnCheck

GHSA-m8p4-rrq5-qvmf

RCE Code Injection Txtai

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated when no TOKEN is set (PR:N), but the required exposed/token-less/writable non-default deployment justifies AC:H; the resolved callable runs in-process giving full C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 22:29 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 22:28 vuln.today

Analysis Updated

Jun 30, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 22:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 22:02 vuln.today

DescriptionCVE.org

txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs __import__ and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured (authentication is opt-in, so all endpoints are unauthenticated) and the index is configured writable, a remote attacker can set function to an arbitrary callable such as subprocess.getoutput, achieving remote code execution as the server process during reindexing. Exploitation requires those deployment conditions (API exposed, no TOKEN, writable index); it is not the default configuration. The fix gates the endpoint behind a new reindex configuration flag.

AnalysisAI

Remote code execution in txtai through 9.10.0 lets a remote attacker reach the API /reindex endpoint and supply an arbitrary dotted callable (for example subprocess.getoutput) that the server imports and invokes during reindexing, running commands as the server process. The flaw is exploitable only when the API is network-exposed with no TOKEN set (so all endpoints are unauthenticated) and the index is writable - not the default posture. No public exploit has been identified at time of analysis, but the issue carries a high CVSS 4.0 base score of 9.3 and was reported by VulnCheck.

Technical ContextAI

txtai (neuml/txtai, CPE cpe:2.3:a:neuml:txtai) is an open-source embeddings/semantic-search framework that ships an optional HTTP API. The vulnerability is a CWE-94 code injection arising from unsafe reflection: the /reindex endpoint passes its caller-supplied 'function' parameter to txtai.util.Resolver, which performs Python __import__ and getattr on the dotted path with no allowlist or type restriction. Because any importable module attribute can be resolved and then called, an attacker can name a dangerous standard-library callable (e.g. subprocess.getoutput, os.system) instead of a legitimate transform function, turning a reindex operation into arbitrary command execution within the server process.

RemediationAI

Apply the upstream fix in commit 11b32da (https://github.com/neuml/txtai/commit/11b32da720f03276199ebc5583c15fc5d1ccafd3), which gates the /reindex endpoint behind a new 'reindex' configuration flag; upgrade to the first tagged release that includes this commit (Upstream fix available via commit; released patched version not independently confirmed, so verify against the vendor changelog). If immediate patching is not possible, configure a TOKEN so all API endpoints require authentication (closes the unauthenticated path but requires updating every API client with credentials), and/or set the index to read-only so reindexing cannot be triggered (disables legitimate reindex/update functionality). Additionally, do not expose the txtai API directly to untrusted networks - place it behind a reverse proxy or network ACL that restricts access to the /reindex endpoint (may break legitimate remote reindex automation). See the VulnCheck advisory above for details.