CVE-2026-103509

{
  "etk_id": "ETK-2026-1703",
  "cve_id": "CVE-2026-103509",
  "display_id": "CVE-2026-103509",
  "ghsa_id": "GHSA-m94h-8qfm-w394",
  "euvd_id": "EUVD-2026-102095",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cleartext credential exposure in P4Search configuration API",
  "summary": "P4Search versions 2026.4.2 and earlier can expose stored credentials through the configuration API. An actor with administrative access to the connected P4 Server may retrieve those credentials and use them to expand access.",
  "mitigation": "Upgrade P4Search to version 2026.4.3 or later. Restrict P4 Server administrative access and rotate credentials that may have been exposed.",
  "vendor": "Perforce",
  "product": "P4 (Helix Core)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2026.4.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.4.3"
      ],
      "package_name": "P4Search",
      "purl": null
    }
  ],
  "cwes": [
    1220
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
  "epss_score": 0.0023,
  "epss_percentile": 0.1287,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 55.662101166666666,
  "t0_at": "2026-10-15T14:41:28.829000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T14:41:28.829000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T14:41:28.829000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103509"
    }
  }
}