CVE-2026-100103
Perfoce P4 (Helix Core)
Published 5 Oct 2026 · updated 5 Oct 2026 · Received
10.0 Critical · CVSS 4.0, puppet.com
Description
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.