CVE-2026-84700 Overview
CVE-2026-84700 is an unauthenticated access vulnerability in PikiwiDB (Pika) v3.5.7. The database exposes an internal protobuf replication server on a port derived from the client port plus 2000 (for example, port 11221 when the default client port 9221 is used). This replication port does not authenticate incoming requests. Although requirepass is intended to gate replication through the masterauth field in MetaSync requests, the frame dispatcher DealMessage routes other message types to their handlers without verifying that authentication ever occurred. An unauthenticated remote attacker can issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests to obtain full database snapshots and live write streams [CWE-306].
Critical Impact
Remote attackers can exfiltrate the entire dataset, tap the live binlog stream, and disrupt replication topology without any credentials.
Affected Products
- PikiwiDB (Pika) v3.5.7
- Deployments exposing the internal protobuf replication port (client port + 2000)
- Instances relying on requirepass as the sole replication gate
Discovery Timeline
- 2026-09-02 - CVE-2026-84700 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84700
Vulnerability Analysis
PikiwiDB (Pika) is a persistent, Redis-compatible key-value database maintained by the OpenAtom Foundation. The replication subsystem in v3.5.7 opens a secondary listener on client_port + 2000 that speaks a protobuf-framed protocol distinct from the Redis wire protocol. This secondary listener is used for master-slave synchronization and is intended to be private, but it binds to the same interfaces as the client port.
The design assumes that a slave will first send a MetaSync request containing the master's password as masterauth. The HandleMetaSyncRequest handler in pika_repl_server_conn.cc validates this value against requirepass. However, the frame dispatcher DealMessage routes incoming protobuf messages to handlers based on the message type field alone. It does not track whether the connection has completed, or even attempted, MetaSync authentication before dispatching other message types.
Root Cause
The vulnerability is a missing authentication for a critical function [CWE-306]. Authentication logic is co-located with a single handler (HandleMetaSyncRequest) rather than enforced at the dispatch layer. Because DealMessage treats each protobuf frame as independently addressable, an attacker can skip MetaSync entirely and invoke privileged replication operations directly.
Attack Vector
An attacker with network reach to the replication port opens a TCP connection and sends protobuf-framed TrySync, DBSync, BinlogSync, or RemoveSlaveNode messages. A DBSync request triggers a full-sync snapshot transfer of the database contents. A BinlogSync request subscribes the attacker to the live write stream. A RemoveSlaveNode request evicts legitimate replicas from the topology. No requirepass, masterauth, or handshake state is required. See the VulnCheck advisory and the pika_repl_server_conn.cc source for the dispatcher logic.
No verified public proof-of-concept code is referenced in the enriched data. The vulnerability mechanism is described in GitHub Issue #3270 and the linked advisory.
Detection Methods for CVE-2026-84700
Indicators of Compromise
- Unexpected inbound TCP connections to client_port + 2000 (default 11221) from hosts outside the configured replica set.
- Outbound transfer of full-database snapshot files initiated by the Pika process to unknown peers.
- Unexplained RemoveSlaveNode events causing legitimate replicas to disappear from the cluster topology.
Detection Strategies
- Correlate network flow telemetry with the Pika replication port and alert on any source IP not present in an allowlist of known replicas.
- Parse Pika server logs for TrySync, DBSync, BinlogSync, and RemoveSlaveNode events and cross-reference initiator addresses against the expected replica inventory.
- Deploy network monitoring rules to flag protobuf traffic on port 11221 originating from client-facing subnets.
Monitoring Recommendations
- Baseline replication traffic volume and alert on anomalous surges consistent with snapshot exfiltration.
- Track replica count changes and alert when nodes leave the topology outside of change windows.
- Ingest Pika logs into a centralized SIEM and correlate replication events with authentication activity on the client port.
How to Mitigate CVE-2026-84700
Immediate Actions Required
- Block network access to the replication port (client_port + 2000, default 11221) at the host firewall and restrict it to known replica IP addresses only.
- Bind Pika to a management interface that is not routable from untrusted networks.
- Audit the replica topology and remove any unauthorized replica registrations discovered during investigation.
Patch Information
The enriched data does not reference a fixed release. Monitor the PikiwiDB GitHub repository and Issue #3270 for a patched version that enforces masterauth validation at the DealMessage dispatcher rather than only in HandleMetaSyncRequest.
Workarounds
- Enforce network segmentation so that only trusted replica hosts can reach the protobuf replication port.
- Place Pika instances behind a VPN or private VPC subnet with strict security group rules.
- Terminate any unexpected connections to the replication port using host-based intrusion prevention rules.
# Example iptables rule restricting the Pika replication port to known replicas
iptables -A INPUT -p tcp --dport 11221 -s 10.0.0.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 11221 -s 10.0.0.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 11221 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.