CVE-2026-84700

PikiwiDB (Pika) v3.5.7 runs an internal protobuf replication server on a port derived from the client port plus 2000 (TCP 11221 when the default client port 9221 is used), and this listener accepts replication commands without any authentication. Although requirepass is intended to gate replication via the masterauth field in a MetaSync request, only the MetaSync handler (HandleMetaSyncRequest) validates it, while the frame dispatcher (DealMessage) routes other message types to their handlers without requiring a completed or attempted MetaSync. An unauthenticated remote attacker who can reach the replication port can therefore send TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests and obtain the full-sync snapshot (a copy of the dataset), tap the live stream of subsequent writes, and remove replica nodes from the replication topology. Any Pika 3.5.7 deployment whose replication port is reachable from an untrusted network is affected, including instances where requirepass is configured, since that setting does not protect this listener. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Until a patched release is published, restrict the replication port (client port + 2000, e.g. TCP 11221 when using the default 9221) at the host or network firewall so only trusted replica addresses can reach it, and where possible bind replication traffic to a private interface; note that setting requirepass does not mitigate this issue. Check running instances for the derived port listening on all interfaces and review its connections/logs for unexpected peers, then upgrade to a fixed version once one is announced.