CVE-2026-6043: Insecure Default Configuration in P4 Server
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P4 Server (P4D)to a version that resolves this vulnerability.Fixed in 2026.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6043?
The severity of CVE-2026-6043 is considered high due to insecure default configurations that can lead to unauthorized access.
How do I fix CVE-2026-6043?
To fix CVE-2026-6043, update your P4 Server to version 2026.1 or later and review your security settings.
What types of systems are affected by CVE-2026-6043?
CVE-2026-6043 affects Perforce P4 Server versions prior to 2026.1.
What risks are associated with CVE-2026-6043?
CVE-2026-6043 allows unauthenticated attackers to create arbitrary user accounts and access existing accounts with no password.
Who is responsible for addressing CVE-2026-6043?
It is the responsibility of system administrators using affected versions of Perforce P4 Server to address CVE-2026-6043.