Perforce P4 Search: Credential disclosure in configuration API
Summary
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API. An attacker with administrative privileges on the connected P4 Server can read these credentials and escalate privileges. The attack requires a valid administrator account and is not possible without authentication.
Affected
- P4 Search 2026.4.2 and earlier
- Sources disagree on the exact range; the vendor record states 2026.4.2 and earlier are affected, with 2026.4.3 as the fix.
Fixed in
- 2026.4.3 (vendor fix)
- Related issue CVE-2026-103508 is also fixed in 2026.4.3.
Workaround
- No vendor workaround known.
- Limit administrator accounts on the P4 Server to the smallest necessary group.
- Restrict access to the P4 Search web UI and configuration API to trusted internal networks.
- Treat credentials stored in P4 Search as exposed and rotate them after the upgrade.
Exploitation
- No public proof of concept or exploit known.
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA ADP SSVC: exploitation none, automatable no, technical impact partial.
- EPSS 0.00229 (low).
Our recommendation
- Upgrade P4 Search to 2026.4.3 if it is in use; prioritise this if the instance is reachable from outside the company network.
- Verify that the related fixes from 2026.4.2 and 2026.4.3 are in place.
- Review which accounts hold P4 Server administrator rights and remove unnecessary ones.
- Rotate credentials stored in P4 Search after the upgrade.
- Monitor access logs of the configuration API for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Perforce CNA advisory portal.perforce.com
- VulDB vuldb.com
- CISA ADP / Vulnrichment vulners.com
- PSIRT psirt.com
- NVD mirror vulners.com
- P4 Search product documentation help.perforce.com
- Community news securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:31.
Original description (NVD)
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.