CVE-2026-100103
P4 (Helix Core): Authentication bypass via default auth token in P4Search
Perfoce P4 (Helix Core)
CVSS
10.0CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Description
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
Text from CVE List
Affected versions 2
- P4 (Helix Core)affected: all versions through 2026.4.1CVE List
- P4 (Helix Core)unaffected: 2026.4.2CVE List