CVE-2026-6043

P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations

CVSS

No CVSS.

References

Link	Resource
https://help.perforce.com/helix-core/server-apps/p4sag/current/Content/P4SAG/secure-by-default-overview.html
https://portal.perforce.com/s/cve/a91Qi000002wRUvIAM/insecure-default-configuration-in-p4-server

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Las versiones del servidor P4 anteriores a 2026.1 están configuradas con ajustes predeterminados inseguros que, al ser expuestas a redes no confiables, permiten a atacantes no autenticados crear cuentas de usuario arbitrarias, enumerar usuarios existentes, autenticarse en cuentas sin contraseña establecida y acceder al contenido del depósito a través del usuario incorporado ’remote’. Estos ajustes predeterminados, tomados en conjunto, pueden conducir a un acceso no autorizado a repositorios de código fuente y otros activos gestionados. La versión 2026.1, prevista para mayo de 2026, impone configuraciones seguras por defecto en actualizaciones y nuevas instalaciones.

Information

Published : 2026-04-24 12:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-6043

Mitre link : CVE-2026-6043

CVE.ORG link : CVE-2026-6043

JSON object : View

Products Affected

No product.

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-6043", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6043", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T12:01:55.145438Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@puppet.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@puppet.com", "affectedData": [{"vendor": "Perforce", "product": "Helix Core Server (P4D)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-24T12:17:07.660", "references": [{"url": "https://help.perforce.com/helix-core/server-apps/p4sag/current/Content/P4SAG/secure-by-default-overview.html", "source": "security@puppet.com"}, {"url": "https://portal.perforce.com/s/cve/a91Qi000002wRUvIAM/insecure-default-configuration-in-p4-server", "source": "security@puppet.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@puppet.com", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations"}, {"lang": "es", "value": "Las versiones del servidor P4 anteriores a 2026.1 est\u00e1n configuradas con ajustes predeterminados inseguros que, al ser expuestas a redes no confiables, permiten a atacantes no autenticados crear cuentas de usuario arbitrarias, enumerar usuarios existentes, autenticarse en cuentas sin contrase\u00f1a establecida y acceder al contenido del dep\u00f3sito a trav\u00e9s del usuario incorporado \u2019remote\u2019. Estos ajustes predeterminados, tomados en conjunto, pueden conducir a un acceso no autorizado a repositorios de c\u00f3digo fuente y otros activos gestionados. La versi\u00f3n 2026.1, prevista para mayo de 2026, impone configuraciones seguras por defecto en actualizaciones y nuevas instalaciones."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security@puppet.com"}