CVE-2026-105278
Received Received - Intake

Hard-Coded Admin Credentials in openPDC Docker Image

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: ICS-CERT

Description
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-105278
EUVD
EUVD-2026-95790

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Grid Protection Alliance openPDC (Docker image) 0
Grid Protection Alliance openPDC (Docker image) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Docker image for openPDC that includes a fixed administrative credential. The credential is not changed on first use, allowing attackers with network access to the management interface to authenticate and gain full administrative control of the application.

Detection Guidance

Check Docker containers running openPDC for default administrative credentials. Inspect network traffic to the management interface for unauthorized authentication attempts using default credentials.

Impact Analysis

An attacker could exploit this to take complete control of the openPDC application, potentially leading to unauthorized access, data manipulation, or disruption of services. This could affect system integrity, confidentiality, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). It may result in legal penalties, loss of trust, and reputational damage.

Mitigation Strategies

Change the default administrative credentials immediately. Restrict network access to the management interface. Update to the latest Docker image version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart