OpenAtomFoundation PikiwiDB up to 4.0.4-alpha MetaSync handler HandleMetaSyncRequest improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in OpenAtomFoundation PikiwiDB up to 4.0.4-alpha. The impacted element is the function HandleMetaSyncRequest of the component MetaSync handler. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-84700. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in OpenAtomFoundation PikiwiDB up to 4.0.4-alpha. It has been declared as critical. Affected by this vulnerability is the function HandleMetaSyncRequest of the component MetaSync handler. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as masterauth inside its MetaSync request — only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-84700 since 09/02/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/02/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• OpenAtomFoundation

Name

• PikiwiDB

Version

• 4.0.4-alpha

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion