CVE-2026-105278— Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
Quick assessment
Affected
Grid Protection Alliance openPDC (Docker image)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
发布在 Docker 镜像中的 openPDC 包含一个固定的默认管理凭据，且首次使用时不强制用户更改。任何拥有网络访问权限的攻击者，若能接触到管理接口，便可以使用该凭据进行身份验证，从而获得应用程序的完全管理控制权。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grid Protection Alliance | openPDC (Docker image) | < 2.9.477 |
affected |
< 2.9.482 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105278
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grid Protection Alliance | openPDC (Docker image) | 0 ~ 2.9.477 | - |
|
II. Public POCs for CVE-2026-105278
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105278
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105278 (2)
Same Patch Batch · Grid Protection Alliance · 2026-10-09 · 6 CVEs total
| CVE-2026-100730 | 9.8 CRITICAL | Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data |
| CVE-2026-104629 | 8.8 HIGH | Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to S |
| CVE-2026-105281 | 7.5 HIGH | Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Fun |
| CVE-2026-85479 | 5.3 MEDIUM | Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Fun |
| CVE-2026-101022 | 4.3 MEDIUM | Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF) |
IV. Related Vulnerabilities
Same vendor: Grid Protection Alliance
-
CVE-2026-104629
Grid Protection Alliance openPDC and openHistorian Use of Ex -
CVE-2026-101022
Grid Protection Alliance openPDC and openHistorian Server-Si -
CVE-2026-85479
Grid Protection Alliance openPDC and openHistorian Missing A -
CVE-2026-105281
Grid Protection Alliance openPDC and openHistorian Missing A -
CVE-2026-100730
Grid Protection Alliance openPDC and openHistorian Deseriali
Same weakness: CWE-798
-
CVE-2026-32645
Red Lion Controls N-Tron 700 Series Use of Hard-Coded Creden -
CVE-2026-84891
Security vulnerability affects the Windows GIM component as -
CVE-2026-84250
IBM Guardium Data Protection Hard-coded Credentials -
CVE-2026-85488
Brocade ASCG<3.5.0默认密码导致提权 -
CVE-2026-85422
Brocade ASCG <3.5.0 硬编码密钥漏洞
V. Comments for CVE-2026-105278
No comments yet