CVE-2026-15535: AkariAsai Self-RAG RCE Vulnerability

CVE-2026-15535 Overview

CVE-2026-15535 is an insecure deserialization vulnerability in the AkariAsai self-rag project, a retrieval-augmented generation research codebase published on GitHub. The flaw resides in the Indexer.deserialize_from function within retrieval_lm/src/index.py in the retrieval_lm component. An attacker who supplies a manipulated index_meta.faiss argument can trigger unsafe deserialization. The project operates on a rolling release model, so no versioned patch exists. The issue has been publicly disclosed and the vendor has not yet responded to the upstream issue report. This weakness is categorized under [CWE-20: Improper Input Validation].

Critical Impact
Remote attackers with low privileges can trigger deserialization of attacker-controlled data via the index_meta.faiss parameter, potentially leading to arbitrary code execution during index loading.

Affected Products

AkariAsai self-rag (rolling release)
Affected commit range: up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99
Component: retrieval_lm — file retrieval_lm/src/index.py

Discovery Timeline

2026-07-13 - CVE-2026-15535 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15535

Vulnerability Analysis

The vulnerability affects the Indexer.deserialize_from method in the self-rag retrieval library. This function loads FAISS index metadata from a file path controlled through the index_meta.faiss argument. When the deserialization routine processes attacker-supplied data without validating its structure or origin, it reconstructs objects from untrusted input. This class of flaw ([CWE-20]) commonly enables code execution when the deserialized data invokes arbitrary Python callables, such as through pickle-based loaders often paired with FAISS metadata storage.

Because self-rag is a research-oriented retrieval-augmented generation framework, deployments frequently expose index-loading routines to shared model artifacts or pipelines that pull artifacts from remote sources. The attack surface expands wherever index files traverse trust boundaries.

Root Cause

The root cause is improper input validation on the index_meta.faiss argument passed to Indexer.deserialize_from. The function trusts the serialized payload and does not verify integrity, provenance, or type constraints before reconstruction. No cryptographic signature or schema validation gates the deserialization step.

Attack Vector

The attack is network-reachable and requires only low privileges. An attacker who can influence the index_meta.faiss input, either by hosting a malicious artifact or by tampering with an index file consumed by the application, triggers deserialization of hostile data. A public proof of concept is referenced in the GitHub Pull Request and the GitHub Issue Tracker.

No verified exploitation code is reproduced here. Refer to the VulDB Vulnerability Details for technical background.

Detection Methods for CVE-2026-15535

Indicators of Compromise

Unexpected index_meta.faiss files appearing in retrieval pipelines from untrusted sources or remote fetches.
Python processes spawning unexpected child processes such as shells or network utilities during index loading.
File integrity mismatches between locally generated FAISS metadata and files retrieved from external storage.

Detection Strategies

Static analysis of retrieval_lm/src/index.py for calls to pickle.load, torch.load, or equivalent deserialization primitives operating on external input.
Runtime monitoring of Python interpreters loading index_meta.faiss for anomalous system calls, file writes outside expected directories, or outbound network connections.
Hash-based allowlisting of approved FAISS metadata artifacts.

Monitoring Recommendations

Log every invocation of Indexer.deserialize_from along with the resolved file path and SHA-256 hash of the loaded artifact.
Alert when retrieval processes execute after loading files sourced from user-writable directories or remote object storage.
Correlate model-serving process telemetry with unexpected outbound connections following index deserialization.

How to Mitigate CVE-2026-15535

Immediate Actions Required

Restrict Indexer.deserialize_from inputs to trusted, integrity-verified FAISS index files only.
Isolate self-rag workloads in sandboxed environments with minimal network egress and file system permissions.
Audit existing FAISS metadata artifacts and re-generate them from trusted source data.
Track the upstream GitHub Pull Request for an official fix.

Patch Information

No official patch is available. The project follows a rolling release model, and the maintainer has not yet responded to the disclosure issue. Monitor the AkariAsai self-rag repository and the GitHub Issue Tracker for updates.

Workarounds

Replace unsafe deserialization with a safe loader that validates schema and rejects arbitrary object reconstruction.
Enforce a cryptographic signature check on index_meta.faiss before invoking deserialize_from.
Run retrieval processes under a dedicated, unprivileged service account with read-only access to index directories.
Block network fetches of FAISS metadata from untrusted origins at the egress proxy.

bash

# Configuration example
# Restrict index directory to read-only for the service account
chown -R root:selfrag /opt/self-rag/indexes
chmod -R 0440 /opt/self-rag/indexes

# Verify artifact integrity before loading
sha256sum -c /opt/self-rag/indexes/index_meta.faiss.sha256 \
  || { echo "Integrity check failed"; exit 1; }