CVE-2026-103509
Received Received - Intake

Stored Credentials Exposure in P4 Search Configuration API

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Perforce

Description
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-103509
EUVD
EUVD-2026-102095

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Perforce P4 (Helix core) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

P4 Search (formerly Helix Search) has a flaw where it exposes stored credentials in cleartext through its configuration API. This occurs when users with administrative privileges on the connected P4 Server access the API, potentially allowing unauthorized privilege escalation.

Detection Guidance

Check if P4 Search (Helix Search) version 2026.4.2 or earlier is running. Review configuration API responses for stored credentials in cleartext. Verify administrative privileges on connected P4 Server.

Impact Analysis

An attacker with administrative access could exploit this to retrieve plaintext credentials, enabling them to gain higher privileges on the P4 Server. This could lead to unauthorized access, data manipulation, or further network compromise.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of credentials and sensitive data. Exposure of plaintext credentials may lead to breaches of GDPR (data protection) or HIPAA (health data security), resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade P4 Search (Helix Search) to version 2026.4.3 or later immediately. Restrict administrative privileges on the P4 Server to minimize exposure. Audit configuration API responses for any exposed credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart