Administrative Credential Vulnerability in openPDC by CISA
CVE-2026-105278

9.3CRITICAL

Key Information:

Vendor

Grid Protection Alliance

Status
Openpdc (docker Image)
Vendor
CVE Published:
9 October 2026

What is CVE-2026-105278?

The openPDC Docker image contains a hardcoded administrative credential that is not required to be changed upon first use. This flaw allows an attacker with network access to the management interface to authenticate using the default credential, thus gaining full control over the application and its associated functionalities.

Affected Version(s)

openPDC (Docker image) 0 < 2.9.477

openPDC (Docker image) 0 < 2.9.482

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shubham Raj (Cipher) of Causal Security reported this vulnerability to CISA.
.