CVE-2026-84700
Received Received - Intake

PikiwiDB Replication Server Authentication Bypass

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as masterauth inside its MetaSync request — only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84700
EUVD
EUVD-2026-69791

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
qihoo pikiwidb 3.5.7
qihoo pika to 4.0.4-alpha (inc)
pika pikiwidb 3.5.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84700 is a high-severity authentication bypass vulnerability in PikiwiDB (Pika) v3.5.7. It exposes an internal protobuf replication server on a port 2000 higher than the client port (e.g., 11221 if the client port is 9221). This server does not require authentication for most replication commands like TrySync, DBSync, BinlogSync, and RemoveSlaveNode. Even when requirepass is set, the replication port fails to enforce it, allowing unauthenticated attackers to access full database snapshots, live write streams, and remove replica nodes.

The vulnerability stems from improper validation in the frame dispatcher, which does not mandate MetaSync completion before processing other commands. Only the MetaSync handler checks requirepass, leaving other replication functions exposed.

Detection Guidance

To detect this vulnerability, scan for open ports on your Pika server that are 2000 higher than the client port (default 9221, so check port 11221). Use commands like 'netstat -tulnp | grep 11221' or 'ss -tulnp | grep 11221' to check for listening replication ports. If the port is open and accessible without authentication, the system is likely vulnerable.

Impact Analysis

An unauthenticated attacker can connect to the replication port and issue commands to obtain full database snapshots, stream live write operations (including sensitive data like SET commands), and remove legitimate replica nodes. This allows data exfiltration, unauthorized access to sensitive information, and disruption of database operations. Even if requirepass is configured, the replication port bypasses it entirely.

Compliance Impact

This vulnerability likely violates compliance requirements for data confidentiality and integrity, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized access to live write streams and full database snapshots could result in data breaches, leading to regulatory penalties, fines, or legal consequences for failing to protect sensitive data.

Mitigation Strategies

Immediately restrict access to the replication port (e.g., port 11221) using firewall rules to allow only trusted IPs. Update Pika to the latest version where this issue is patched. If updating is not possible, disable the replication port or ensure requirepass is properly configured and enforced on all replication-related commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart