by Kastro
Paper/Archive/CVE-2026-105278

CVE-2026-105278

Grid Protection Alliance openPDC (Docker image) — Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 27.7.277 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

Affected

ProductAffectedFixed inSource
openPDC (Docker image)< 2.9.4772.9.477CNA
openPDC (Docker image)< 2.9.4822.9.482CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-281-02refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json