Client Address Vulnerability in Perforce P4 Search Product
CVE-2026-103512

5.3MEDIUM

Key Information:

Vendor

Perforce

Status
P4 (helix Core)
Vendor
CVE Published:
5 October 2026

What is CVE-2026-103512?

The vulnerability in Perforce P4 Search arises from the application's improper validation of client-supplied addresses during certain authentication processes. This flaw allows attackers in possession of a stolen P4 Server ticket to circumvent host-based restrictions and trusted-address controls. As a result, these attackers can gain unauthorized access to the P4 Search interface, impersonating the legitimate ticket holder and potentially compromising sensitive data.

Affected Version(s)

P4 (Helix Core) 0 <= 2026.4.1

P4 (Helix Core) 0 <= 2026.4.1

P4 (Helix Core) 2026.4.2

References

https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/tick...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khoa Bui (https://github.com/zenniskayy2k4)
.