CVE-2026-84700

Name of the Vulnerable Software and Affected Versions PikiwiDB (Pika) version 3.5.7

Description The internal protobuf replication server is exposed on a port calculated by adding 2000 to the client port (for example, port 11221 if the default client port is 9221). This server fails to authenticate incoming requests. While the requirepass configuration is intended to restrict replication, only the HandleMetaSyncRequest() function validates it. The frame dispatcher DealMessage() does not verify if a MetaSync process was completed or attempted before routing messages. Consequently, an unauthenticated remote attacker can connect to the replication port and execute TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests to obtain full-sync snapshots, access live write streams, or remove replica nodes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.