CVE-2026-6043
Insecure Default Configuration in P4 Server
- State
- Published
- Severity
- 8.8 High
- Published
- Apr 24, 2026
- Updated
- Apr 28, 2026
- Reserved
- Apr 9, 2026
Description
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | Perforce |
Weaknesses
- CWE-1188 Initialization of a resource with an insecure default
Affected Products
| Product | Versions |
|---|---|
Helix Core Server (P4D)Perforce |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.