Key points
- CVE-2026-105278 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The flaw affects Grid Protection Alliance openPDC Docker images before versions 2.9.477 and 2.9.482.
- Attackers can authenticate with the fixed administrative credential to gain full control of the application.
Developers using openPDC must immediately inspect their deployments for hardcoded administrative credentials that allow unrestricted access to the application. The National Vulnerability Database published CVE-2026-105278 on Monday, rating the vulnerability as Critical with a CVSS score of 9.8. This flaw exists in the published Docker images for the Grid Protection Alliance’s openPDC software, exposing users to potential administrative takeover if the management interface is reachable from the network.
The vulnerability stems from a fixed administrative credential embedded within the Docker image that does not force a password change upon first use. According to the NVD record, an attacker with network access to the management interface can simply authenticate using this known credential. This action grants the attacker full administrative control of the application, bypassing standard security controls. The issue is classified under CWE-798, which relates to use of hardcoded credentials, a common weakness in containerized applications that are not properly configured for secure initialization.
What we know
The National Vulnerability Database identified the affected software as the Grid Protection Alliance openPDC Docker image. The record specifies that versions before 2.9.477 and versions before 2.9.482 are vulnerable to this administrative takeover. The description notes that the published image includes the fixed credential without any mechanism to enforce a change on first use. This means that any deployment relying on these specific image versions retains the default access path indefinitely unless manually altered by the administrator.
No patch or updated image version has been confirmed by the vendor in the available source material as of the NVD record publication. The CVSS 9.8 rating reflects the high severity of the impact, which includes complete loss of confidentiality, integrity, and availability of the application. Attackers do not need to exploit complex code execution vulnerabilities; they only need network access to the management interface to leverage the static credential. This makes the threat particularly dangerous for environments where the openPDC interface is exposed to untrusted networks or lacks strict network segmentation.
Defender's checklist
- Verify if your organization uses Grid Protection Alliance openPDC in a Docker container environment.
- Check the current version of the openPDC Docker image against the vulnerable ranges listed in the NVD record.
- Confirm whether the management interface is accessible from networks that could be reached by external attackers.
- Audit logs for any successful authentication events using the default or fixed administrative credentials.
What to do and how to stay safe: openPDC
- Isolate affected openPDC containers from untrusted networks until you can verify credential status.
- Rotate all administrative credentials immediately if you are using a vulnerable Docker image version.
- Implement network segmentation to restrict access to the openPDC management interface to authorized hosts only.
- Monitor authentication logs for unexpected login attempts using known default or static credentials.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which openPDC versions are affected by CVE-2026-105278?
The NVD record states that Grid Protection Alliance openPDC Docker images before version 2.9.477 and before version 2.9.482 are affected.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-105278 as Critical with a CVSS score of 9.8.
Is there a patch available for this flaw?
No fix or updated image has been confirmed in the source material; users must mitigate by rotating credentials and restricting network access.
