CVE-2026-100103

validated

GHSA-crr7-cpqh-vjm5 ↗EUVD-2026-92291 ↗

check availableproven exploitable

cve.orgpublic pockev

Perfoce P4 (Helix Core) <= 2026.4.1

CWE-1392 Use of Default Credentials

ETK-2026-635, permanent identifier

cvss10.0cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

+1h51mTTV

1h 07mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck + exploit+1h51m

+1h

+2h

description

P4Search container images earlier than 2026.4.2 can reset their service authentication token to a publicly known default. An unauthenticated attacker able to reach the service may obtain highest-level application access and could affect the connected P4 Server, including through possible code execution.

mitigation

Upgrade P4Search container images to version 2026.4.2 or later. Limit network access to the service until all affected deployments are updated.

check

available

exploit

yes

automation

deterministic

auth required

EPSS

0.42%35th percentile

agent run time

1h 07m

cve.org record, t = 0

2026-10-05 08:19Z

Δ to public poc

–

Δ to kev

–

outcome

Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-05 08:19Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-100103

this entry in the feed

GET /api/v1/feed/CVE-2026-100103

{
  "etk_id": "ETK-2026-635",
  "cve_id": "CVE-2026-100103",
  "display_id": "CVE-2026-100103",
  "ghsa_id": "GHSA-crr7-cpqh-vjm5",
  "euvd_id": "EUVD-2026-92291",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Default authentication token bypass in P4Search",
  "summary": "P4Search container images earlier than 2026.4.2 can reset their service authentication token to a publicly known default. An unauthenticated attacker able to reach the service may obtain highest-level application access and could affect the connected P4 Server, including through possible code execution.",
  "mitigation": "Upgrade P4Search container images to version 2026.4.2 or later. Limit network access to the service until all affected deployments are updated.",
  "vendor": "Perfoce",
  "product": "P4 (Helix Core)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2026.4.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "P4Search",
      "purl": null
    }
  ],
  "cwes": [
    1392
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": 0.0042,
  "epss_percentile": 0.3536,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 66.58774598333333,
  "t0_at": "2026-10-05T08:19:47.970000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-05T10:10:20.965465+00:00",
      "days": 0.0767707808449074,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T08:19:47.970000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-05T10:10:20.965465+00:00",
      "days": 0.0767707808449074,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T08:19:47.970000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-05T08:19:47.970000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T08:19:47.970000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100103"
    }
  }
}

published 2026-10-05 09:03Z
last change 2026-10-21 11:38Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.