Unauthenticated Remote Vulnerability in PikiwiDB v3.5.7

CVE-2026-84700

What is CVE-2026-84700?

PikiwiDB version 3.5.7 exposes an internal protobuf replication server on a port that is derived from the client port, which is accessible without authentication. This vulnerability allows an unauthenticated remote attacker to connect to the replication port and issue sensitive commands like TrySync, DBSync, BinlogSync, and RemoveSlaveNode, potentially leading to unauthorized access to the full-sync snapshot and live write stream. The issue arises because only certain replication requests are validated, permitting exploitations even with security measures like 'requirepass' in place.

References