Remote Code Execution Vulnerability in txtai by Neuml

CVE-2026-58449

What is CVE-2026-58449?

The txtai product, up to version 9.10.0, is exposed to a remote code execution vulnerability due to an API endpoint, /reindex, that resolves caller-supplied parameters without an allowlist. If this API is exposed without authentication (TOKEN not configured) and the index is writable, an attacker could exploit this to execute arbitrary code on the server. The exploitation conditions must be met, as they do not represent the default configuration, and fixes have been implemented to secure the endpoint.

References