CVE-2026-103512: Ticket host-binding bypass via spoofed client IP in P4Search
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perforce P4 Searchto a version that resolves this vulnerability.Fixed in 2026.4.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
P4 Search deployments prior to 2026.4.2 are exposed when P4 Server tickets are protected using host-based ticket restrictions or trusted-address controls. An attacker must possess a stolen P4 Server ticket to exploit the bypass.
Does an attacker need valid credentials to exploit this?
The attacker needs a stolen P4 Server ticket belonging to the account they intend to access as. The issue lets them spoof the client address used during authentication validation, bypassing the ticket's host-binding and trusted-address restrictions.
How can I determine whether my deployment is affected?
Check the version of Perforce P4 Search in use. Versions earlier than 2026.4.2 are affected; the provided information does not identify any other configuration prerequisite beyond use of the affected authentication validation path.