CVE-2026-100103
CriticalCVSS 10.0Summary
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
Risk Assessment
The risk includes the possibility of remote arbitrary code execution and full compromise of the service, potentially leading to security breaches across the entire P4 environment.
Recommendation
It is recommended to immediately update P4 Search container images to version 2026.4.2 or later. Also, change the default authentication token to a strong, unique, and non-public value.
Other vulnerabilities in P4 Search
See all- CVE-2026-103510Critical
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.
- CVE-2026-100102Critical
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
Original NVD description (English source)
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS