CVE-2026-84700 Details
Description
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as masterauth inside its MetaSync request — only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.
A vulnerability in PikiwiDB version 3.5.7 allows unauthenticated access to the internal protobuf replication server. This server is exposed on a port derived from the client port, plus 2000, and lacks authentication for incoming requests. Although the 'requirepass' configuration is intended to secure replication, only the MetaSync request is validated. As a result, an attacker can directly connect to the replication port and issue commands that synchronize databases, access live write streams, and remove replica nodes, even when 'requirepass' is set.
Users can update to PikiwiDB version 4.0.4-alpha or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenAtomFoundation/pikiwidb | [email protected] | ProductSource CodeVendor |
| https://github.com/OpenAtomFoundation/pikiwidb/blob/v3.5.7/src/pika_repl_server_conn.cc | [email protected] | Source CodeVendor |
| https://github.com/OpenAtomFoundation/pikiwidb/issues/3270 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/pika-unauthenticated-replication-access-via-internal-protobuf-port | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenAtomFoundation PikiwiDB | <= 4.0.4-alpha (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |