CVE-2026-103509

Credential Disclosure in P4 Search Configuration API

State: Published
Severity: 8.5 High
Published: Oct 15, 2026
Updated: Oct 15, 2026
Reserved: Sep 30, 2026

Description

P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H	Perforce

Weaknesses

CWE-1220 Insufficient granularity of access control

Affected Products

Product	Versions
P4 (Helix core)Perforce	2026.4.3 and earlierAffected 2026.4.3Not affected

References

https://portal.perforce.com/s/cve/a91Qi000003Gdi1IAC/credential-disclosure-in-p4-search-configuration-api

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.