CVE-2026-100103

Perforce P4 Search container images before 2026.4.2 reset the service authentication token to a publicly documented default value (CWE-1392). An unauthenticated attacker who can reach the service over the network can use that default token to gain the highest application privilege. That access can lead to arbitrary code execution and compromise of the connected P4 Server. Organizations running affected P4 Search container images are impacted. There is no known public proof-of-concept and the issue is not listed in CISA KEV.

What to do: Upgrade Perforce P4 Search container images to 2026.4.2 or later and replace the service authentication token so it is no longer the documented default. Restrict network access to the P4 Search service, and review the connected P4 Server for unauthorized privileged activity.