CVE-2026-105278: Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials

Critical severity · published Oct 9, 2026

CVE-2026-105278

Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials

9.8

CVSS

0.3%

EPSS

On KEV

Description

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 28% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

openPDC (Docker image) · Grid Protection Alliance

before 2.9.477; before 2.9.482 · source: vendor

In the news

VulnerabilityCritical

Grid Protection Alliance openPDC and openHistorian

View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) openHistorian <2.8.580, <2.8.585 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) CVSS Vendor Equipment v3 9.8 Grid Protection Alliance openPDC 5 Vulnerabilities Deserialization of Untrusted Data, Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), Use of Hard-coded Credentials, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which coul...

CVE-2026-104629 CVE-2026-100730 CVE-2026-105281

Oct 8, 2026·CISA Advisories

Affected product

openPDC (Docker image)

Grid Protection Alliance

All openPDC (Docker image) CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-105278

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-105278

www.cisa.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02

github.com

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json