Vulnerability · Published Oct 5, 2026 · Assigned by Perforce
CVE-2026-103512Ticket host-binding bypass via spoofed client IP in P4Search
Medium 5.3
In plain English
A medium-severity authentication bypass by spoofing in P4 (Helix Core) from Perforce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Perforce | P4 (Helix Core) | 0 – through 2026.4.1 |
Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N