CVE-2026-105278: Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the published openPDC Docker image are exposed if their management interface is reachable by an attacker over the network.
What does an attacker need to exploit it?
An attacker needs network access to the management interface. No prior authentication, privileges, or user interaction are required because the image includes a fixed administrative credential.
What access can exploitation provide?
Successful authentication with the fixed credential gives the attacker full administrative control of the application.
Does the Docker image require the administrator to change the included credential before it can be used?
No. The included administrative credential has no forced change on first use.