CVE-2026-100103: Perforce P4Search Authentication Bypass via Default Auth Token
Perforce P4 Search container images before 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access could obtain the highest application privilege, which may lead to code execution and compromise of the connected P4 Server.
Overview
Perforce has disclosed an authentication bypass affecting P4 Search container images before 2026.4.2. The affected images set the service authentication token to a value that is publicly documented, so anyone aware of that default can authenticate to the service.
Impact
- An unauthenticated attacker with network access may obtain the highest application privilege.
- The record states that this could potentially lead to arbitrary code execution and compromise of the connected P4 Server.
- The CVSS assessment supplied in the record is 10 (critical), with high confidentiality, integrity and availability impact.
Affected products and versions
- Perforce P4 Search container images before 2026.4.2.
- The record gives the affected range as 2026.4.1 and earlier, which is consistent with the 2026.4.2 boundary stated in the description.
- The product field in the record contains a spelling variant of the vendor name, so the vendor advisory should be used as the authoritative product reference.
Exploitation status
The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. EPSS gives a probability of 0.00424 (percentile 0.35652) as of 2026-10-23, and the SSVC data lists exploitation as none and automatable as no.
Remediation and mitigation
- Upgrade P4 Search container images to 2026.4.2 or later, since the description indicates that this version addresses the default token behavior.
- Until the upgrade is complete, restrict network access to the P4 Search service to trusted administrative hosts.
- After upgrading, confirm that the service authentication token is no longer the publicly documented default and rotate any credentials that may have been exposed.
- Consult the vendor advisory for any additional guidance.
Detection guidance
- Review P4 Search access logs for unexpected administrative or privileged requests from unfamiliar sources.
- Inventory deployed container images and their configuration to identify instances running versions before 2026.4.2.
- Monitor the connected P4 Server for unexpected changes, especially after any suspicious P4 Search activity.
Limitations of the available information
The record contains no fixed-version list and no structured fix references, so the 2026.4.2 boundary comes from the description. The list of affected image tags, deployment patterns and any prerequisites beyond network reachability are unknown. The record status is Awaiting Analysis, so scoring and details may change.
Frequently asked questions
Which P4 Search versions are affected?
According to the description, container images before 2026.4.2 are affected. The record gives the range as 2026.4.1 and earlier. The exact image tags affected are unknown from the record.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. Defenders should still prioritize upgrading.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.