# CVE-2026-103512: Perforce P4 Search ticket validation bypass in client IP handling

Source: https://junglewise.ai/threats/cve-2026-103512-perforce-p4-search-prior-to-2026-4-2-trusts-a-client-supplied  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103512 · Severity: info · Published 2026-10-05

Perforce P4 Search is a search and indexing service for version control repositories. A vulnerability in authentication ticket validation allows an attacker with a stolen P4 Server ticket to bypass host-based access restrictions and gain unauthorized access to P4 Search as the legitimate ticket owner, effectively impersonating that user without needing their password.

Technologies: [Perforce P4 Search](https://junglewise.ai/threats/technologies/p4-search). Vendors: [Perforce](https://junglewise.ai/threats/vendors/perforce).

## Quick answers

**Is CVE-2026-103512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103512 being exploited in the wild.

**How severe is CVE-2026-103512?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Perforce P4 Search prior to 2026.4.2.

**Is there a fix for CVE-2026-103512?** Yes: fixed in P4 Search 2026.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103512 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-103512?** Check whether you run Perforce P4 Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in P4 Search 2026.4.2

## Technical details

P4 Search trusts a client-supplied address when validating authentication requests, failing to properly enforce host-based ticket restrictions and trusted-address controls. An attacker in possession of a valid P4 Server ticket can spoof their client IP address to bypass these restrictions. The vulnerability requires a stolen or compromised ticket but does not require network access from the ticket's legitimate origin.

## Affected products

- Perforce P4 Search prior to 2026.4.2

## Timeline

- 2026-10-05: disclosed

## References

- [https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search](https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search)

## Related threats

- [P4 Search credential disclosure in configuration API](https://junglewise.ai/threats/cve-2026-103509-p4-search-formerly-helix-search-returns-stored-credentials-in)
- [Perforce P4 Search path traversal via logging configuration](https://junglewise.ai/threats/cve-2026-103508-p4-search-formerly-helix-search-allows-an-authenticated-user)
- [Perforce P4 Search arbitrary file write in extension installation](https://junglewise.ai/threats/cve-2026-103511-perforce-p4-search-prior-to-2026-4-2-does-not-validate-file)
- [Perforce P4 Search authentication bypass via blank auth token](https://junglewise.ai/threats/cve-2026-103510-p4-search-prior-to-2026-4-2-does-not-fail-securely-when-its)
- [Perforce P4 Search arbitrary file write in logging configuration](https://junglewise.ai/threats/cve-2026-103507-perforce-p4-search-prior-to-2026-4-2-does-not-restrict-file)