# CVE-2026-105278: Grid Protection Alliance openPDC Docker hardcoded credential

Source: https://junglewise.ai/threats/cve-2026-105278-the-published-docker-image-for-openpdc-includes-a-fixed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105278 · Severity: critical · CVSS 9.8 · Published 2026-10-09

openPDC is a data acquisition and management system for electrical grid monitoring and control. The published Docker image contains a fixed administrative username and password that cannot be changed on first login, allowing any attacker with network access to the management interface to assume full administrative control and potentially disrupt critical power grid operations.

Technologies: [Grid Protection Alliance openPDC (Docker image)](https://junglewise.ai/threats/technologies/openpdc-docker-image). Vendors: [Grid Protection Alliance](https://junglewise.ai/threats/vendors/grid-protection-alliance).

## Quick answers

**Is CVE-2026-105278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105278 being exploited in the wild.

**How severe is CVE-2026-105278?** Critical severity, with a CVSS score of 9.8, published 9 October 2026.

**Which products and versions are affected?** Grid Protection Alliance openPDC (Docker image) before 2.9.482.

**Is there a fix for CVE-2026-105278?** No fixed version is recorded yet. Grid Protection Alliance does not recommend production use of published Docker images. Deploy openPDC from source or use alternative distribution methods; if Docker images must be used, immediately change administrative credentials after deployment and restrict network access to the management interface using firewall rules.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105278 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-105278?** Check whether you run Grid Protection Alliance openPDC (Docker image) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Grid Protection Alliance does not recommend production use of published Docker images. Deploy openPDC from source or use alternative distribution methods; if Docker images must be used, immediately change administrative credentials after deployment and restrict network access to the management interface using firewall rules.</anigation>
</invoke>

## Technical details

The openPDC Docker image ships with hardcoded administrative credentials and lacks forced credential change on initial deployment. An unauthenticated network attacker can authenticate to the management interface using these credentials, gaining complete administrative access to the application. This vulnerability affects the Docker image distribution only; the vendor does not plan to fix it in the published images.

## Affected products

- Grid Protection Alliance openPDC Docker image before 2.9.482

## Timeline

- 2026-10-08: disclosed
- 2026-10-09: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02)

## Related threats

- [Grid Protection Alliance openPDC data publisher missing authentication](https://junglewise.ai/threats/cve-2026-105281-the-internal-data-publisher-on-openpdc-accepts-network)
- [Grid Protection Alliance openPDC and openHistorian deserialization and authentication vulnerabilities](https://junglewise.ai/threats/cve-2026-104629-grid-protection-alliance-openpdc-and-openhistorian)
- [Grid Protection Alliance openPDC and openHistorian unsafe deserialization](https://junglewise.ai/threats/cve-2026-100730-a-service-console-interface-on-openpdc-and-openhistorian)