CVE-2026-105278 Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
Attackers can use hard-coded admin credentials in the openPDC Docker image to gain full administrative control of the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105278?
CVE-2026-105278 is a critical vulnerability in Grid Protection Alliance openPDC (Docker image), published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Weakness: CWE-798
Which versions are affected by CVE-2026-105278?
How do I fix CVE-2026-105278?
No fix has been published for CVE-2026-105278 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105278 being exploited?
There is no known exploitation of CVE-2026-105278 in the wild and no public exploit code.
Sources
Also known as GHSA-99g4-gvqf-7f8p.