CVE-2026-100103: Authentication bypass via default auth token in P4Search

Q: Which deployments are exposed?

Perforce P4 Search container images prior to version 2026.4.2 are affected. Exploitation requires network access to the P4 Search service.

Q: What level of access can an attacker gain?

An unauthenticated attacker can use the publicly documented default authentication token to obtain the highest application privilege. This may enable arbitrary code execution and compromise of the connected P4 Server.

Published Oct 5, 2026

Updated

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.

Affected Software

1 affected component

Perforce P4 Search<2026.4.2

Event History

Oct 5, 2026

CVE Published

via MITRE·08:19 AM

Data Sourced

via MITRE·08:19 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Perforce P4 Search container images prior to version 2026.4.2 are affected. Exploitation requires network access to the P4 Search service.

What level of access can an attacker gain?

An unauthenticated attacker can use the publicly documented default authentication token to obtain the highest application privilege. This may enable arbitrary code execution and compromise of the connected P4 Server.