Key points
- The flaw is rated CVSS 9.8 Critical by the National Vulnerability Database.
- It affects openPDC Docker images prior to versions 2.9.477 and 2.9.482.
- Attackers can exploit the issue if they have network access to the management interface.
A severe security flaw in the openPDC Docker image allows unauthorized users to take complete control of the application. The vulnerability exists because the software includes a fixed administrative credential that does not require users to change the password upon first login.
In plain English
The openPDC software, often used for grid protection, has a default backdoor. The published Docker image contains a pre-set username and password for the administrator account. The system does not force users to create a new password when they first install or run the image. If an attacker can reach the management interface over the network, they can simply log in with these known credentials. Once inside, they have full administrative rights to the application.
The background
The National Vulnerability Database (NVD) assigned CVE-2026-105278 to this issue. It is classified as a Critical severity flaw with a CVSS score of 9.8. The weakness is categorized under CWE-798, which relates to use of hardcoded credentials. The vulnerability affects the openPDC Docker image maintained by the Grid Protection Alliance. Specifically, it impacts versions before 2.9.477 and versions before 2.9.482.
What changes now
Security teams must identify any instances of openPDC running in Docker containers. If the running version is older than 2.9.477 or 2.9.482, the system is vulnerable. Because the credential is fixed within the image, changing the password manually may not be sufficient if the image itself remains unpatched. Organizations should verify their current version against the affected list.
What to do and how to stay safe: openPDC
- Inventory all Docker containers to identify those running openPDC and check their version numbers against the affected list (before 2.9.477 and before 2.9.482).
- Restrict network access to the openPDC management interface, ensuring it is not exposed to untrusted networks or the internet.
- Monitor logs for authentication attempts using the known default credentials, which may indicate exploitation attempts.
- Plan to update to a patched version of the Docker image once the vendor provides an update that removes the hardcoded credential.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-105278?
It is a critical vulnerability in openPDC Docker images that includes a fixed administrative credential with no forced password change on first use.
Which versions of openPDC are affected?
The vulnerability affects openPDC Docker images before version 2.9.477 and before version 2.9.482.
How severe is this vulnerability?
The National Vulnerability Database rates it as Critical with a CVSS score of 9.8.
