Read the docs
TI-2026-70054 Aliases CVE-2026-105278

Hard-coded credentials in openPDC Docker image allow admin access

Priority MEDIUM 42CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Grid Protection Alliance openPDC Docker image versions from 0 before 2.9.477 and from 0 before 2.9.482 are affected. The published image includes a fixed administrative credential with no forced change on first use (CWE-798). An attacker with network access to the management interface can authenticate with this credential and gain full administrative control of the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Fix Fixed openPDC (Docker image) (Grid Protection Alliance): 2.9.477, 2.9.482

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Grid Protection AllianceopenPDC (Docker image)before 2.9.477; before 2.9.4822.9.477, 2.9.482Patch availableCNA
  • openPDC (Docker image) VendorGrid Protection Alliance Affected before 2.9.477; before 2.9.482 Fixed in 2.9.477, 2.9.482 Patch available CNA

Remediation

Fixed versions for the openPDC Docker image are 2.9.477 and 2.9.482.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA openPDC (Docker image) (Grid Protection Alliance) Fixed in 2.9.477, 2.9.482

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Grid Protection Alliance openPDC (Docker image) 2.9.477, 2.9.482

    6 records Highest priority Priority MEDIUM 3 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-70017 Untrusted data deserialization in openPDC and openHistorianPriority MEDIUM 49
    • TI-2026-70024 Missing authentication in Grid Protection Alliance openPDC and openHistorianPriority MEDIUM 43
    • TI-2026-70023 Unsafe reflection in Grid Protection Alliance openPDC and openHistorianPriority LOW 36
    Show all 6 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-105278
  2. 2026-10-11 CISA SSVC decision points changed

References

Other 2

  • TI-2026-70017 Untrusted data deserialization in openPDC and openHistorian CVSS 4.0CRITICAL 9.3
  • TI-2026-70024 Missing authentication in Grid Protection Alliance openPDC and openHistorian CVSS 4.0HIGH 8.7
  • TI-2026-70023 Unsafe reflection in Grid Protection Alliance openPDC and openHistorian CVSS 4.0HIGH 7.7
  • TI-2026-70004 Missing authentication in openPDC and openHistorian data publisher CVSS 4.0MEDIUM 6.9
  • TI-2026-70018 Server-side request forgery in openPDC and openHistorian CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences