CVE-2026-84700

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as masterauth inside its MetaSync request — only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.

• CWE-306

• https://github.com/OpenAtomFoundation/pikiwidb
• https://github.com/OpenAtomFoundation/pikiwidb/blob/v3.5.7/src/pika_repl_server_conn.cc
• https://github.com/OpenAtomFoundation/pikiwidb/issues/3270
• https://www.vulncheck.com/advisories/pika-unauthenticated-replication-access-via-internal-protobuf-port

Published

Sep 2, 2026

Last Modified

Sep 2, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84695BookStack before 26.05.4 contains a stored cross-site script…8.7
• CVE-2026-84696Phison PS3111-S11 controller firmware versions through SBFQT…8.2
• CVE-2026-84697Mailpit's IsInternalIP deny list function fails to block the…5.3
• CVE-2026-84698PX4 Autopilot contains a heap buffer overflow vulnerability …6.5
• CVE-2026-84699Team Password Manager before 14.184.308 fails to enforce aut…9.1
• CVE-2026-8470IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3,…9.1
• CVE-2026-84701NocoBase fails to sanitize rich text field values in the rea…5.4
• CVE-2026-84702facefusion through 3.6.1 fails to normalize job identifiers …7.5
• CVE-2026-84715FeatherPanel versions before 1.3.7.10 fail to validate permi…8.8
• CVE-2026-8472GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-84732Retransmissions of ACK packet ID in OpenVPN through 2.6.22 a…8.7
• CVE-2026-84736In the current development version of Eclipse aeriOS, for wh…8.3