P4Search vulnerabilities
CVEs whose affected-version data names the P4Search package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
8 CVEsRSS
CVE-2026-103508High· 7.3P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging…
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging…
CVE-2026-103509High· 8.5P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier …
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier …
CVE-2026-100103Critical· 10.0Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentiall…
CVE-2026-103507High· 7.5Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to cod…
CVE-2026-100102Critical· 9.5Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to c…
CVE-2026-103512Medium· 5.3Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, …
CVE-2026-103511Medium· 5.1Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installatio…
CVE-2026-103510Critical· 9.5P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially lead…