PikiwiDB Pika CVE-2026-84700

The replication port (client_port + 2000, default 11221 when the client port is 9221) must be network-reachable from the attacker - this is the sole prerequisite. No authentication, session state, prior interaction, or special configuration is required. An attacker connects directly and issues TrySync, DBSync, BinlogSync, or RemoveSlaveNode protobuf messages without completing or initiating a MetaSync handshake. The requirepass and masterauth configuration directives, which are intended to protect the replication channel, are entirely ineffective because authentication is enforced only in the MetaSync handler (HandleMetaSyncRequest), not in the frame dispatcher (DealMessage). The vulnerability is present in the default installation of v3.5.7 whenever the replication port is accessible. Exploitation is limited exclusively by network reachability to the replication port; if that port is firewalled to trusted replication peers only, the attack surface is eliminated.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) accurately reflects the low barrier to exploitation: the replication port is network-reachable, requires no credentials, and the attack involves constructing valid protobuf messages - a task derivable from the open-source codebase. The confidentiality impact is severe (VC:H), as a DBSync request yields the entire database contents, including all application data stored on the primary. Integrity impact is rated low (VI:L) because an attacker can remove replica nodes and disrupt replication topology but cannot inject arbitrary writes to the primary. Availability impact is likewise low (VA:L), since replica removal degrades redundancy without halting the primary service. No CISA KEV listing exists and no public exploit code has been confirmed, meaning the risk is driven by attack surface characteristics rather than observed in-the-wild exploitation. The predictable port derivation formula (client_port + 2000) makes reconnaissance trivial - even a mid-sized municipal IT team in gdynia managing a handful of PikiwiDB nodes should treat this as urgent if the replication port is reachable from untrusted networks, because there is no configuration option that closes the authentication gap without patching or external network controls. No conflicting signals exist between the technical description and the supplied CVSS vector.

An attacker scans for or predicts the replication port (default 11221) on a PikiwiDB host and establishes a raw TCP connection without performing any MetaSync handshake. The attacker crafts a valid protobuf DBSync request - derivable from the open-source codebase - and transmits it directly; the frame dispatcher routes it to the DBSync handler without any authentication check, and the server begins streaming a full RDB snapshot of the database. The attacker may follow with BinlogSync requests to maintain a live feed of all subsequent writes, achieving continuous data exfiltration. No confirmed public POC exists at time of analysis, but the open-source nature of the codebase makes independent exploit construction straightforward.