Executive brief
PikiwiDB is a Redis-compatible database that uses a separate internal replication server for data synchronization between primary and replica nodes. An attacker can connect directly to this replication server without authentication and extract the entire database or remove replica nodes, even when password protection is configured. This can lead to complete data breach and loss of database replicas.
Technical details
The vulnerability is an authentication bypass in the protobuf-based replication server (listening on client_port + 2000). Although requirepass is intended to gate replication via MetaSync requests that present masterauth, the frame dispatcher (DealMessage) does not enforce authentication before routing TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests to their handlers. An unauthenticated remote attacker can connect to the replication port (network-accessible, no authentication required) and issue these commands to perform a full-sync snapshot dump, stream live writes, or remove replica nodes. The root cause is missing authentication validation at the dispatcher level, with checks only in the MetaSync handler. No patch information is currently indicated in the advisory.
Affected products
- OpenAtomFoundation PikiwiDB (Pika) v3.5.7
Timeline
- 2026-09-02: disclosed