Grid Protection Alliance openPDC: Hard-coded credential in Docker image
Summary
The published Docker image of Grid Protection Alliance openPDC contains a fixed administrative credential that is not forced to change on first use. An attacker with network access to the management interface can log in with this credential and gain full administrative control of the application. The vendor has not published a fix for the Docker image and does not recommend production use of published Docker images.
Affected
- openPDC Docker image: versions below 2.9.482 (the advisory lists below 2.9.477 and below 2.9.482)
- Non-container openPDC installations are listed separately and are not the subject of this CVE.
Fixed in
- Docker image: Unknown. The vendor has not published a fix and lists "no fix planned".
- openPDC 2.9.482 and later includes additional serialization validation, but the vendor does not explicitly tie this change to CVE-2026-105278.
Workaround
- Do not run the published Docker image in production.
- If the image must keep running, change or remove the built-in credential where the configuration allows it.
- Restrict network access to the management interface, for example behind a firewall or a properly secured VPN.
- Monitor authentication logs of the application.
- Unknown: the default management port and whether the interface can be bound to localhost in the container.
Exploitation
- CISA reports no known exploitation (SSVC: Exploitation none, Automatable no).
- Unknown whether public exploit code exists.
Our recommendation
- Replace the Docker image with a non-container openPDC installation at 2.9.482 or later, or build your own image from the fixed release.
- Set your own administrative credential during deployment.
- Check whether any openPDC Docker instance is reachable from untrusted networks and isolate it.
- Monitor authentication logs for unusual logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICSA-26-281-02 advisory www.cisa.gov
- CSAF document ICSA-26-281-02 github.com
- CVE record CVE-2026-105278 (CVE List V5) raw.githubusercontent.com
- Rapid7 via Vulners vulners.com
- TheHackerWire CVE-2026-105278 www.thehackerwire.com
- Safeguard.sh analysis of ICSA-26-281-02 safeguard.sh
- openPDC releases (GitHub) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:44.
Original description (NVD)
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.