EUVD-2026-92315
GHSA-rgmx-jfh8-6fx8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attack (PR:N) gated on a victim-side blank-token condition beyond attacker control (AC:H); scope changes to the connected P4 Server (S:C) with full CIA impact.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
3DescriptionCVE.org
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.
AnalysisAI
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remote attacker with network access to the service can obtain the highest application privilege, potentially compromising both P4 Search and the P4 Server it is connected to (CWE-636). The vendor rates this CVSS 4.0 9.5; our independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attack requires the victim deployment to be running in the blank-token configuration (Attack Requirements: Present), meaning deployments that set a non-blank service authentication token are not exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted P4 Search instance be running with a BLANK service authentication token - the 'affected configuration' the advisory describes; when the token is blank the service fails open and grants the highest application privilege. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a CVSS-inflated paper risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade P4 Search to 2026.4.2 or later, the first release in which the blank-token condition fails securely rather than granting the highest application privilege; because the exploitability window is defined by 'prior to 2026.4.2', upgrading closes the issue rather than merely reconfiguring around it, and the vendor advisory at https://portal.perforce.com/s/cve/a91Qi000003FDw5IAG/authentication-bypass-via-blank-auth-token-in-p4search should be followed for build artefacts and any additional deployment guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Perforce P4 Search instances and confirm whether the service authentication token is blank; if blank, immediately set a strong unique non-blank token or, if that cannot be done safely, isolate the P4 Search service from untrusted networks and from the connected P4 Server, and review logs for anomalous privileged activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in P4 Helix Core
View allUnauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images pri
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exp
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Se
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allShare
External POC / Exploit Code
Leaving vuln.today