CVE Intelligence
Analysis AI-assisted

CVE-2026-105278: Grid Protection Alliance openPDC Docker Image - Hard-coded Credentials

CVE-2026-105278 affects the published Docker image of Grid Protection Alliance openPDC, which ships with a fixed administrative credential that is not forced to change on first use. The record scores it critical (CVSS 3.1 9.8), and it is classified as CWE-798 (Use of Hard-coded Credentials). No confirmed exploitation appears in the sources consulted, and the record does not list a specific fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Docker image published for Grid Protection Alliance openPDC includes a fixed administrative credential. The application does not require that credential to be changed on first use, which is why the weakness is classified as CWE-798, Use of Hard-coded Credentials. The record associates the issue with CNA ICS-CERT and the advisory ICSA-26-281-02.

Impact

According to the description in the record, an attacker with network access to the management interface can authenticate with the fixed credential and gain full administrative control of the application. The CVSS 3.1 vector in the record (AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H) describes a network-reachable issue requiring no privileges or user interaction, with high impact to confidentiality, integrity and availability. The record reports a CVSS 3.1 base score of 9.8 and a CVSS 4.0 score of 9.3.

Affected products and versions

  • Grid Protection Alliance openPDC, published Docker image, versions less than 2.9.477.
  • Grid Protection Alliance openPDC, published Docker image, versions less than 2.9.482.

The record lists these two ranges without stating which one applies to each release line. Deployments built from images within these ranges should be treated as potentially affected until the vendor or CISA advisory is checked.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The SSVC exploitation value is recorded as none and automatable as no. The EPSS probability is 0.00342 (percentile 0.25868) as of 2026-10-13. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Identify every deployment of the openPDC Docker image and compare the running version with the ranges listed above.
  • The record does not list a fixed version. Consult the CISA advisory and the vendor guidance for the exact release that removes the fixed credential, and do not assume a version is safe without that confirmation.
  • Where the fixed credential cannot be removed immediately, restrict access to the management interface to trusted administrative networks and place it behind segmentation or a VPN.
  • Rotate any administrative credential that may have been left at its shipped value, and enforce credential changes at first use.
  • Review whether the management interface is reachable from untrusted networks, since the record describes network access as the attack path.

Detection guidance

  • Review authentication logs for the management interface for successful administrative logins that do not match known operator activity, especially logins from unexpected source addresses.
  • Verify that the administrative account configuration has been changed from its shipped state.
  • Monitor for unexpected configuration changes or new administrative accounts in openPDC deployments.
  • Confirm that management interface exposure is inventoried and that unexpected external reachability is flagged.

Limitations of the available information

The record does not include a fixed version, a vendor patch identifier, or a description of the exact credential or its default value, and this analysis does not provide those details. The relationship between the two listed version ranges and specific release branches is not stated. The CVSS 4.0 score is taken from ICS-CERT entries in the record and has not been independently verified against the vendor advisory.

Frequently asked questions

What is the vulnerability in CVE-2026-105278?

The published Docker image for Grid Protection Alliance openPDC includes a fixed administrative credential that is not required to be changed on first use, classified as CWE-798.

Which versions are listed as affected?

The record lists the openPDC Docker image as affected in the ranges less than 2.9.477 and less than 2.9.482, without stating which applies to each release line.

Is there a fixed version?

The record does not list a fixed version. Check the CISA advisory ICSA-26-281-02 and vendor guidance for the exact remediated release.

Is this vulnerability being exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.