Perforce P4 Search: Authentication bypass via default token in container images
Summary
Perforce P4 Search container images before version 2026.4.2 set the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can use this token to obtain the highest application privilege, which can lead to arbitrary code execution and compromise of the connected P4 Server. The CISA SSVC assessment lists exploitation as none and automatable as no, but the flaw is network-reachable and needs no authentication.
Affected
- P4 Search container images, versions 0 to 2026.4.1 (default configuration affected)
Fixed in
- P4 Search 2026.4.2 or later (per CVE record). Verify the latest release on the Perforce portal, as a separate P4 Search flaw (CVE-2026-103508) is reported as resolved in 2026.4.3.
Workaround
Unknown. No vendor-documented workaround was found. Whether setting a non-default token mitigates the issue is not confirmed by the sources.
Exploitation
- CISA Known Exploited Vulnerabilities (KEV) status: not confirmed in the sources; check the CISA catalogue directly.
- Public proof of concept: unverified.
- Exploitation requires only knowledge of the publicly documented default token and network access.
Our recommendation
- Identify whether P4 Search runs in your environment and confirm the container image version.
- Upgrade to the latest Perforce P4 Search release, not only 2026.4.2.
- Do not expose P4 Search to the internet; restrict access to the internal network or known hosts.
- Rotate credentials held by P4 Search after patching.
- Check logs for unexpected access to P4 Search and the connected P4 Server.
- Verify publication and release dates on the vendor advisory, as sources differ.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Perforce Support Portal advisory for CVE-2026-100103 portal.perforce.com
- CVE List V5 record CVE-2026-100103 raw.githubusercontent.com
- SecurityOnline: Perforce P4 Search vulnerabilities securityonline.info
- DEV Community: P4 Search default service token analysis dev.to
- HOL Guard: CVE-2026-100103 hol.org
- CVE intel page CVE-2026-100103 cve.imfht.com
- Strix: CVE-2026-103508 www.strix.ai
- VulDB: CVE-2026-100103 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:42.
Original description (NVD)
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.