CVE-2026-103509High· 8.5▾ TwilightP4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103508High· 7.3P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging…
CVE-2026-100103Critical· 10.0Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value
CVE-2026-103507High· 7.5Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface
CVE-2026-100102Critical· 9.5Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface
CVE-2026-103512Medium· 5.3Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests
CVE-2026-103511Medium· 5.1Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature