Insecure Default Configuration in P4 Server by Perforce

CVE-2026-6043

What is CVE-2026-6043?

P4 Server versions prior to 2026.1 are shipped with insecure default settings that can leave installations vulnerable to unauthorized access. When these configurations are exposed to untrusted networks, attackers can exploit them to create arbitrary user accounts, enumerate existing users, and authenticate to accounts that do not have passwords set. This can lead to unauthorized access to sensitive depot contents and source code repositories. The release of version 2026.1 addresses these vulnerabilities by enforcing secure-by-default configurations.

References