CVE-2026-103509: Credential Disclosure in P4 Search Configuration API
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P4 Searchto a version that resolves this vulnerability.Fixed in 2026.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrative privileges on the P4 Server connected to P4 Search. The exposed credentials can then be used for privilege escalation.
Which deployments are affected and what version fixes the issue?
Perforce P4 Search versions 2026.4.2 and earlier are affected. The issue is fixed in version 2026.4.3.
How can I determine whether my deployment may be vulnerable?
Check the installed P4 Search version and whether users have administrative privileges on the connected P4 Server. Deployments running 2026.4.2 or earlier with such administrative users should be treated as affected.