CVE-2026-103509 PUBLISHED

Credential Disclosure in P4 Search Configuration API

Assigner: Perforce
Reserved: 30.09.2026 Published: 15.10.2026 Updated: 15.10.2026

P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS Score: 8.5

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	None	Integrity	High
Attack Requirements	None	Availability	None	Availability	High
Privileges Required	High
User Interaction	None

CVSS 4.0

Product Status

Vendor	Perforce
Product	P4 (Helix core)
Versions	Default: unaffected affected from 0 to 2026.4.3 (incl.) Version 2026.4.3 is unaffected

References

https://portal.perforce.com/s/cve/a91Qi000003Gdi1IAC/credential-disclosure-in-p4-search-configuration-api

Problem Types

CWE-1220 Insufficient granularity of access control CWE