EUVD-2026-69791
GHSA-747h-6gh8-p8v2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated replication port with no complexity barriers; C:H from full DB snapshot via DBSync; I:L and A:L from replica removal; no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication - a slave presents it as masterauth inside its MetaSync request - only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.
AnalysisAI
Unauthenticated remote access to PikiwiDB (Pika) v3.5.7's internal protobuf replication server allows attackers to exfiltrate complete database snapshots and intercept live write streams without any credentials. The replication port - exposed on a fixed, predictable offset from the client port (default 11221) - routes TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests directly without requiring a prior authenticated MetaSync handshake, rendering the requirepass/masterauth configuration control entirely ineffective. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The replication port (client_port + 2000, default 11221 when the client port is 9221) must be network-reachable from the attacker - this is the sole prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) accurately reflects the low barrier to exploitation: the replication port is network-reachable, requires no credentials, and the attack involves constructing valid protobuf messages - a task derivable from the open-source codebase. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been identified at time of analysis; GitHub issue #3270 at https://github.com/OpenAtomFoundation/pikiwidb/issues/3270 documents the flaw but no fix commit or tagged release is confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all PikiwiDB (Pika) v3.5.7 deployments in your environment and verify whether the replication port (default 11221) is accessible from outside your organization's trusted network boundaries; immediately implement firewall rules to block all external access to this port, allowing only connections from explicitly trusted internal replication nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today