CVE-2026-58449: txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter

Synopsis

An unauthenticated remote code execution vulnerability exists in txtai versions through 9.10.0, caused by unsafe reflection in the /reindex API endpoint. The endpoint resolves a caller-supplied function parameter by calling __import__ and getattr on any dotted Python path with no allowlist, allowing any reachable caller to supply an arbitrary callable such as subprocess.getoutput. Exploitation is possible without any credentials over the network when the API is exposed without a TOKEN and the index is configured writable; successful exploitation gives the attacker code execution as the server process. A patched-image rebuild at commit 11b32da720f03276199ebc5583c15fc5d1ccafd3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the txtai API service over the network; any internet- or LAN-exposed deployment is in scope.

• AuthenticationNot required

  No credentials are needed because authentication in txtai is opt-in and the vulnerable endpoint is fully unauthenticated when no TOKEN is configured.

• Victim interactionNot required

  No user or administrator action is required; the attacker sends a crafted API request directly to the /reindex endpoint.

• Attack complexityDetail

  The exploit is reliable and condition-free at the network level, though it does require that the target deployment exposes the API without a TOKEN and with a writable index.

Blast Radius

• The attacker executes arbitrary operating system commands as the server process, giving them full control over anything that process can reach.
• All data held in the txtai index is readable and modifiable, including any documents, embeddings, or stored records.
• The server process itself can be crashed, corrupted, or hijacked, disrupting any service or pipeline that depends on the txtai API.
• From the compromised server process, the attacker can pivot to other internal services or credentials accessible from that host.