{"id":"CVE-2026-105278","state":"PUBLISHED","title":"Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials","description":"The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.","publishedAt":"2026-10-09T14:01:21.533Z","updatedAt":"2026-10-11T17:05:28.955Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Grid Protection Alliance openPDC (Docker image)"],"affected":[{"vendor":"Grid Protection Alliance","product":"openPDC (Docker image)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.9.477","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2.9.482","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/105xxx/CVE-2026-105278.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-105278","state":"PUBLISHED","datePublished":"2026-10-09T14:01:21.533Z","dateUpdated":"2026-10-11T17:05:28.955Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-10-05T16:54:01.631Z"},"containers":{"cna":{"title":"Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials","descriptions":[{"lang":"en","value":"The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application."}],"affected":[{"vendor":"Grid Protection Alliance","product":"openPDC (Docker image)","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.9.477","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2.9.482","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","lang":"en","description":"CWE-798","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-10-09T14:01:21.533Z"},"workarounds":[{"lang":"en","value":"Grid Protection Alliance does not recommend production use of published Docker images in any case. The fix for this vulnerability has not been published to the Docker image.","supportingMedia":[{"type":"text/html","base64":false,"value":"Grid Protection Alliance does not recommend production use of published Docker images in any case. The fix for this vulnerability has not been published to the Docker image."}]}],"credits":[{"lang":"en","value":"Shubham Raj (Cipher) of Causal Security reported this vulnerability to CISA.","type":"finder"}],"source":{"advisory":"ICSA-26-281-02","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105278","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-11T16:50:12.885035Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-11T17:05:28.955Z"}}]}}}